Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 05:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
  • Size 4.2MB
  • Sample260930-fnckfsvy2p
  • SHA256 19d4f5565a491d8b842112474b503541b68313a0f9ed89d948e7c6e743c0791f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0E5.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5008
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC402.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4392
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2388
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2852
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD131.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:956
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3208
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2604
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5484
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2460
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5624
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0F0.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3396
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3012
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6AD.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3620
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:592
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43A.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5524
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1828
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6D9.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3900
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5952
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC67.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1524
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2580
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE5B.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4400
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4292
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5736
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3432
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36C.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3060
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1664
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA33.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1228
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4736
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCC.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5888
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4636
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFF.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5096
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3264
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a128F.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4052
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5128
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14C2.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1576
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2688
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E5.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5072
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3716
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18F8.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3892
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:476
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AFB.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:932
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1912
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BE6.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1456
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5148
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CEF.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3928
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1380
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DBB.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:6140
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4860
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EB5.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3300
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5456
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FBE.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3352
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3256
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2089.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2556
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3776
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2164.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3360
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2796
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a223F.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4044
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:6104
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a231A.bat
                                                                                                                              62⤵
                                                                                                                                PID:2192
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4988
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23E5.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3672
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5864
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B0.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3108
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:3192
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258B.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2456
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:3764
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2665.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:3444
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3196
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2740.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:2552
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:4476
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27EC.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:4712
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3348
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28D6.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:1440
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5572
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2992.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1996
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3856
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A8C.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:5400
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:6064
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B67.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:2920
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:2708
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C41.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:2524
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4628
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D0C.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                    PID:4020
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2692
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E06.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3080
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:5092
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F10.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                              PID:6044
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FCC.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:3212
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3068.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                        PID:244
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4728
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3133.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                              PID:4188
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31FE.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32C9.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2132
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3385.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:4132
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:3888
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3421.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3876
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:440
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34EC.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5236
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:1252
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35D6.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36D0.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:424
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a379C.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                  PID:1668
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3886.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3951.bat
                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A0D.bat
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:1184
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AC8.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B74.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:5388
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:3752
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C2F.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4436
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CDB.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                    PID:4124
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D87.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:3568
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E23.bat
                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:5160
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:5508
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EEF.bat
                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:2900
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F8B.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4037.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4102.bat
                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:1488
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:3972
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41CD.bat
                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4588
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:5228
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4298.bat
                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:3304
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4334.bat
                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:5212
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43E0.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1088
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a447C.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4509.bat
                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3228
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2896
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45B5.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4440
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4670.bat
                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a474B.bat
                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2464
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4845.bat
                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:980
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:2828
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48F1.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5328
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:2028
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49AD.bat
                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:5988
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:484
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A49.bat
                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4060
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AE5.bat
                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:680
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4080
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B91.bat
                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5083.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a514E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5209.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5351.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a547A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5526.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a569D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5739.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5804.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a595C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D54.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6090.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a612C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6265.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1944
                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                        C:\Windows\Logo1_.exe
                                                                                                        2⤵
                                                                                                        • Creates a file in the Startup directory
                                                                                                        • Executes dropped EXE
                                                                                                        • Enumerates connected drives
                                                                                                        • Drops file in Program Files directory
                                                                                                        • Drops file in Windows directory
                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3628
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                          3⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5728
                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                            4⤵
                                                                                                              PID:2920

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                            Reconnaissance

                                                                                                            Resource Development

                                                                                                            Initial Access

                                                                                                            Execution

                                                                                                            Command and Scripting Interpreter

                                                                                                            1
                                                                                                            T1059

                                                                                                            Windows Command Shell

                                                                                                            1
                                                                                                            T1059.003

                                                                                                            Persistence

                                                                                                            Boot or Logon Autostart Execution

                                                                                                            1
                                                                                                            T1547

                                                                                                            Registry Run Keys / Startup Folder

                                                                                                            1
                                                                                                            T1547.001

                                                                                                            Privilege Escalation

                                                                                                            Boot or Logon Autostart Execution

                                                                                                            1
                                                                                                            T1547

                                                                                                            Registry Run Keys / Startup Folder

                                                                                                            1
                                                                                                            T1547.001

                                                                                                            Defense Evasion

                                                                                                            Credential Access

                                                                                                            Credentials from Password Stores

                                                                                                            1
                                                                                                            T1555

                                                                                                            Credentials from Web Browsers

                                                                                                            1
                                                                                                            T1555.003

                                                                                                            Unsecured Credentials

                                                                                                            1
                                                                                                            T1552

                                                                                                            Credentials In Files

                                                                                                            1
                                                                                                            T1552.001

                                                                                                            Discovery

                                                                                                            Peripheral Device Discovery

                                                                                                            1
                                                                                                            T1120

                                                                                                            Query Registry

                                                                                                            1
                                                                                                            T1012

                                                                                                            System Information Discovery

                                                                                                            1
                                                                                                            T1082

                                                                                                            System Location Discovery

                                                                                                            1
                                                                                                            T1614

                                                                                                            System Language Discovery

                                                                                                            1
                                                                                                            T1614.001

                                                                                                            System Network Configuration Discovery

                                                                                                            1
                                                                                                            T1016

                                                                                                            Lateral Movement

                                                                                                            Collection

                                                                                                            Data from Local System

                                                                                                            1
                                                                                                            T1005

                                                                                                            Command and Control

                                                                                                            Exfiltration

                                                                                                            Impact

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            $$a128F.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a128F.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 f379eb9e32502e4aa7f8d8d97d9bf905b6b3f58975369708bdf964e2d13a5948
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a14C2.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a14C2.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 fa2f0514f71f8fa41a1c094691cf1bdb3933f3fc123213201984aa1904062912
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a16E5.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a16E5.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 6a842116b824a60971ee671e1ead7c222dc8315e459a8382ba1a8ffa5fc0bf69
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a18F8.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a18F8.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 8bd97bf13f5fd91df73613d2cddb353bfaee8c41b08f403331cec93776132c13
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a36C.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a36C.bat
                                                                                                            • Size 775B
                                                                                                            • SHA256 e31445ea095beaa9e63d8d2043f2b1f73be2184598cd402242ad3e92db3c2111
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aA33.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA33.bat
                                                                                                            • Size 775B
                                                                                                            • SHA256 f4a7c9c07ac4c97ef6f3522f831c86b385549f9b08434e519604cbade00ce49b
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aBD.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBD.bat
                                                                                                            • Size 774B
                                                                                                            • SHA256 411d9953d324d8001ed07310b19cb6b4dfc7cdc9354908393fef840eea5fab7e
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aC0E5.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC0E5.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 cb5981465f5184aa34d53ad6a02f9b525ea3db231b0879b86e274bf707760603
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aC402.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC402.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 7aa8c29a9722a94d50aa1f4c0c308c15e0833b84e9bafd7d14b64a8858508d82
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aCBB3.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 2a31abeee10056b4e600f02a4ca60ffa6daee1b93d9403e76c6eb90ff20b50e0
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aD131.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD131.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 ea2de4346d053c1094b14c5bd6063607943cf85efc4e924618631c15c220352c
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aD6AF.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 1095c50ec1e43389f8df40015ee4ada2bcf53a99215bc57734317c273564dfeb
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aDCC.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDCC.bat
                                                                                                            • Size 775B
                                                                                                            • SHA256 9d56fbcea8b9ceb0dee1d1f7ea2c38d1b29941a67904d7ab40342578d6db97cc
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aDE6F.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 086dd8b7fab30b229179882ac5424b21523db5e78cc16a2c7b04dc1d3594ada8
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aE0F0.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE0F0.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 883ec1db414203620aefb2159fd6cebf05373c2697223c3be1f80e6910c903ed
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aE6AD.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE6AD.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 77a551f9e54237e1f6c714bb5df6f8c2631d1e2123baa16c053f47a76cd311a4
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aF43A.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF43A.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 84d468110ee52e83a7320dd5454d2f65845d53c2bc4b7d2f1cf7d9b48aec53df
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aF6D9.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF6D9.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 093970495f4eb50dec2a9a56d94502759275db26745dc89be75f30e738bb55c7
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aFC67.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFC67.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 d3a388ec0eb177800825731423a09a58e9e41aeaa7b82704fec72f00c7111cda
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aFE5B.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFE5B.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 4b44e3ebdfa0b9204e97691fda7f969b9c2795cc26ba2d3ba2941646abf998de
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aFFF.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFFF.bat
                                                                                                            • Size 775B
                                                                                                            • SHA256 2f363618b3882a156a205225c5ba0683888a285a2ce88c00df5efa476b4776e8
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 e261d813863a3ccdd1517027cefd41fd7ed99035830d7858a8bb41aac7f8e908
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 759b1859ce7effd90413a2b638fb0b1fc09d11b9f699645c840d4edecf713258
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 7407cc52a50e8924fbe47e17d785a2ced5fd6eecea276f468aca11bcb29ff6ce
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 f57edd2bc1e6e884a2511196b6b7b585a9078c50846b9aaf2126e920b999935d
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 daadcec826590924e498a15ad176dc3970bb7254d901cbe18218113fa750b14a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 bb9cd72d125096356e47169e82efb729fd821f5f084fd3d9eb78dc43f87f7ad8
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 b30ef278ffa9f04ce5ce5e6b2a451fcb5bde7a393e7fcbe2d1598b93a4606539
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 8a5ecc1d526e315c8dc2bdab5ed869692fb06adfe9b4f8ef0eeadbfafced0ec4
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 312a387a0f1379bd3ac3c30df7d9f4b33d1a027c810299465d6f249cbbf6330d
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 0ffed4d0c0b3693f7bd802f9635e1d1c3e6c877013e78dfbe4d450d26e7357b7
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 e15aace4f883770d6f09ee54bf2d37fe062e524ba8222d1f19c431712e7279fb
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 42a6158ca08262ef0655e1b768b5be3d34fc1c70e73fa3ac746b4f2183ada463
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 a76753c1e28be32a66cea5de48b3f47ba5d5d1457041d93868b37bcbe87b362b
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.2MB
                                                                                                            • SHA256 4980dec6c1e22f64a89d0cb20562613511220d579f69d33e1bf3101f5da3c986
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 100e9e217e0f63dccdfe18df7d4e16a9c306925722c8b5da12cd370b9b7bf023
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 a88dd5995d5a13fe1c4ee4930c89462bec579e061e9b4796d565e128b37192f1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 13e4a8a65f7b1784cacbb7c995eaf2b49e4a750aae94cd9c3cf1bb01785e0e60
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 c3a9983aa511289049730d0216cb83cf40dcdb0ae0ebfa5688dd980f6179d06b
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 4687804f9b07f907accf23ed58180840b5bb5ac2841b071df35bd81f5719ae0d
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_17e9ee5cc709555b07cbf11a93a11fab_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.5MB
                                                                                                            • SHA256 2da921234d93e847c3059567b34579f7e41e303fa1877633a35ecb2307b6ef09
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Logo1_.exe
                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                            • Size 32KB
                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            _desktop.ini
                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                            • Size 9B
                                                                                                            • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            memory/424-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/440-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/476-8104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/484-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/592-5551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/692-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/720-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/720-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/892-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1088-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1144-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1184-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1196-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1252-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1264-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1352-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1360-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1380-8119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1384-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1396-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1452-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1496-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1548-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1664-7496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1672-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1704-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1772-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1828-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1912-8109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2028-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2388-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2412-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2488-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2488-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2580-6036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2668-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2688-8090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2692-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2708-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2760-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2796-8144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2828-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2896-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2916-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2948-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3012-2621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3024-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3048-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3188-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3192-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3196-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3208-371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3212-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3256-8134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3264-8074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3304-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3348-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3372-8285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3432-6056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3516-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3628-8059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3628-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3628-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3628-3056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3628-1828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3700-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3716-8098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3752-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3764-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3776-8139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3856-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3888-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3972-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3984-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4080-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4100-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4144-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4164-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4208-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4292-6048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4368-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4436-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4476-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4492-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4600-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4628-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4636-8064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4660-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4728-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4736-8055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4772-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4796-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4856-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4860-8124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4896-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4912-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4988-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5008-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5036-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5044-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5092-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5128-8082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5148-8114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5228-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5324-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5456-8129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5484-1824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5508-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5552-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5572-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5620-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5624-1833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5656-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5724-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5792-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5800-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5864-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5952-6028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5964-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6020-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6036-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6064-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6092-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6104-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6136-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download