Overview

overview

7

Static

static

3

2026-10-01...op.exe

windows10-2004-x64

7

2026-10-01...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 17:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
  • Size 1.4MB
  • Sample261002-vvytla1cqa
  • SHA256 17b3812ccc030d70a11d8f0331088c691a77470229c38b33b95e348f7a2493bb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 34 IoCs
  • Executes a command shell one-liner 1 TTPs 31 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7805.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5140
      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C3B.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4740
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4140
              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4808
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EBB.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4744
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3140
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FA6.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1216
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5712
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a810D.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2232
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:236
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81E8.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5592
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5696
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82E2.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4104
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1336
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83CC.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1792
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2036
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8488.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:2056
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:464
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8582.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2052
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1992
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a864D.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3260
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2020
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8718.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:792
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2988
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8841.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4788
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2928
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5528
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1116
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2528
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4660
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3668
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3184
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BCB.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3452
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1192
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CA6.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3752
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5512
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D71.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2120
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4324
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FD2.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5312
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2192
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9716.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5032
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3508
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9800.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4356
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4580
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5008
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2520
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B6.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:952
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2884
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA280.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5544
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4944
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF03.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4484
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5604
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:6024
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4984
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB02C.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1320
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5808
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4732
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3424
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB155.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:704
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5024
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5200
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4628

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        $$a7805.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a7805.bat
        • Size 776B
        • SHA256 19a3410d955cbcef7576b751a2bde46388ba850ab3a2426c4e268a23b6e1ed0e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a7C3B.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a7C3B.bat
        • Size 776B
        • SHA256 43e6cc24556e4ebd0c12eeab1994aaaa06628f49cd328638d92f6ade57910377
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a7DA2.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
        • Size 776B
        • SHA256 ef0f3152fc91b5b10ac6e3cc0223acd59af40bb53df8b75f5d7fee7a0ee2fd8c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a7EBB.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a7EBB.bat
        • Size 776B
        • SHA256 34516b5fc6c905c2c80a784f68bf7a9b0403c9106a8ee39de94cc7eb24e30192
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a7FA6.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a7FA6.bat
        • Size 776B
        • SHA256 be517cab88661bbb23ace09ed1205ccd97166a5922ed10a42b895a0ee9c92bb1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a810D.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a810D.bat
        • Size 776B
        • SHA256 a5911ebe10823cee8356c1cd6849b4dd4c0d24e09f20cd81708fdba91c97ef79
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a81E8.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a81E8.bat
        • Size 776B
        • SHA256 272eda10ad7f9d621897648adc6649dcd142da65d5fb556861010b4f1679d32d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a82E2.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a82E2.bat
        • Size 776B
        • SHA256 94cd767366258e8a0b5f27dddbbf6041e48b0c0f95520f46a210d4ffdece0e22
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a83CC.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a83CC.bat
        • Size 776B
        • SHA256 ebc3ad7abf4d4131a1298d5c232aa90698a645c266a1335f434d470fb6763025
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8488.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8488.bat
        • Size 776B
        • SHA256 1a62aca8f6bfa02093b662f78f09987b56889baa4ca6e4899a9c51b34cb18e27
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8582.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8582.bat
        • Size 776B
        • SHA256 60b2974ea33f33df3d2b180690e2c3746184bc0abf9b274263798d4d68fe9c3a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a864D.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a864D.bat
        • Size 776B
        • SHA256 a1f5bfc59195aab61008f5881803684bdbfee57a13600fb196a66a88f1629a5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8718.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8718.bat
        • Size 776B
        • SHA256 105260adca5b178e28996d7b5ef7c7275eae35b1c4e7a859776d7b8bf82de709
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8841.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8841.bat
        • Size 776B
        • SHA256 eed6febd4a02dae3d1123f20286f96cc1032d06de4d6c872730a6dbbe750df69
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a893B.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
        • Size 776B
        • SHA256 5b6ca873335edcd60265ce725a94bb319ff69279f51649d1994fc8c7542e74fa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8A45.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat
        • Size 776B
        • SHA256 2073110cecca7c15dbd0d79a11341f3cee7375e5e712a85fc80792af44368a68
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8B10.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat
        • Size 776B
        • SHA256 c0678e3d8b4d079d92677f4eed84cb3a84de8893ea1301c31ce9e6f556be205d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8BCB.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8BCB.bat
        • Size 776B
        • SHA256 fcfbb8685af3c616d6f52e4a17420f4ecb4738d4521f5ca6f2b2623de0cb204b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8CA6.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8CA6.bat
        • Size 776B
        • SHA256 1514f50fd7b45f1cdcf2e171e26d389d75702dc2f39cc5197234ee02d148b76d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8D71.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8D71.bat
        • Size 776B
        • SHA256 f1db38615abb469e1374003747d8f0fc23cd761b5269ed9ce83261f61e17d34f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        $$a8FD2.bat
        • Path C:\Users\Admin\AppData\Local\Temp\$$a8FD2.bat
        • Size 776B
        • SHA256 59148fdfb521c1101fa66dbcdc896526dbbf47161a778791f0bf50c3dbb8002d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.4MB
        • SHA256 299c5288ea789cbf39643e92f787a57298bd52f9f27f755fd3fc8e5a2357f78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.3MB
        • SHA256 e288e67eaa369b3746f7524d26f2b278bb76673f61e9687369708bb4b7f662bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 899KB
        • SHA256 deb57d41ea2cd85cb5db308a5613a0926ceae2b158bbf6f8cd2567704141c795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.3MB
        • SHA256 41fc4e1ec96e4bb2f9859e4b3af42362b4d6a61224b826f7ac2cdfa0aeca0f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.3MB
        • SHA256 81af0648baec1b7638f74bab33f391fcf346e7cbc7f0362f8d4dc5e29e1a9a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 834KB
        • SHA256 20891c251c63ad7ad5ff83119533c32329f5e5c03eeaeabd40e16cd5fa4bfa81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.2MB
        • SHA256 2d74d6704f985307d7da023575204d03d703852bd9f6d4e0cd66ff7427045de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.2MB
        • SHA256 8d9a8f2f939a7e3da86dff2f10af9c46a15d9ccf5ad46ad4565e871b8c209ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 768KB
        • SHA256 fbdd2b9cba95746a8f3d3251265c8ae99adad0dff4e5e42829fca977144c1027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.2MB
        • SHA256 1e65d6c72420ee9057f09204860818b500057be00d9ef52d06542aa993a5282c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.1MB
        • SHA256 c1f3f93f4beb5f93764aad9d1bad17ac8a1b497f89f16ed638b5edd3f4b37625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.1MB
        • SHA256 7b73cdde1e3ad880b82b2c11295a9cf8e5279848e082e83adbe11b6312eecc9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.1MB
        • SHA256 216e54114290d939859775ea4b8b4e9c69e746f03c551a1c28718c1852f5594f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.0MB
        • SHA256 bba464317b1f39f5e87e2010d498e860ea2343a4b951b5ed37f028278f6512d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 1.0MB
        • SHA256 7231166a9f44b902a32a722596d36122d266fa887987a0e7db3da09ed3f2d4dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 998KB
        • SHA256 b7b3972cbd2277007dea2518573756f6161c2c91ee07b9c895b3b5b5ce18f51e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 965KB
        • SHA256 3d9bc6ca5afcbd553a6c17311185c969de7f06127a8f5896f5257ac543eb7c27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 932KB
        • SHA256 13f8e16dfac4e3b23aba1ec12737e23e5ccd632d325e4a40362765b0d8c6fc91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 867KB
        • SHA256 f257f7cc25f7e3451658900c3a9f99a686beaeb50f2617d3a931b47b3e2967de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_2fdfa8f17a113294f827f30126ac5f28_amadey_elex_smoke-loader_stop.exe.exe
        • Size 801KB
        • SHA256 dbc59e904c817982492cb1cc2bd9032f6cae35c77c99cb1756dbd97cbcb5cabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Logo1_.exe
        • Path C:\Windows\Logo1_.exe
        • Size 32KB
        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _desktop.ini
        • Path F:\$RECYCLE.BIN\_desktop.ini
        • Size 9B
        • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
        • MD5 SHA1 SHA512
        Submit Download

        memory/236-77-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/464-113-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/1116-165-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/1192-192-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/1336-95-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/1992-127-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2020-136-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2036-104-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2192-1971-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2400-23-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2520-1989-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2884-4372-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2928-154-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/2988-145-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/3140-52-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/3184-183-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/3424-5723-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/3424-5728-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/3508-1977-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4244-0-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4244-10-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4324-519-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4580-1983-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4660-174-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4740-34-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4808-43-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4944-5703-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/4984-5715-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5200-3126-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5200-118-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5200-11-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5200-8298-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5512-201-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5604-5709-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5696-86-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5712-62-0x0000000000400000-0x0000000000445000-memory.dmp
        Download

        memory/5808-5721-0x0000000000400000-0x0000000000445000-memory.dmp
        Download