Overview

overview

7

Static

static

3

2026-10-10...op.exe

windows10-2004-x64

7

2026-10-10...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 23:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
  • Size 4.1MB
  • Sample261011-2y2g8ast4p
  • SHA256 ef6611b991941947613581fea84001682e5ecf32eaa2877d18b668bcbca9ff46
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FFF.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3228
      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3406.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6040
          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5776
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a360A.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3048
              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:112
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3927.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:260
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3956
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B1B.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4108
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5248
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5188
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5968
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F22.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3472
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2816
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4135.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1148
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2976
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4349.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2452
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5988
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a452D.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5404
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5332
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B19.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5428
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4128
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4920
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:8
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a522D.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4892
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3324
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D39.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:984
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:820
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6538.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5148
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3180
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2020
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1348
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6894.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3020
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1728
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BFF.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1240
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4888
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DB4.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3648
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4648
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4748
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4204
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716D.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3464
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2852
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A95.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1140
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2544
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B60.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:296
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4212
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C1C.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2924
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2380
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CF6.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2644
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1060
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DF0.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2776
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4424
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ECB.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5912
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5512
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1756
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1764
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8032.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1388
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4968
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80EE.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2464
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3540
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81B9.bat
                                                                                                                              62⤵
                                                                                                                                PID:3876
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4800
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:1304
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:4268
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a836F.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:5692
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2432
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8449.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:4544
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1520
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8543.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3920
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5964
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a862E.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:4460
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5516
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:2064
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4344
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87E3.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:5656
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:2276
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88AE.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:4200
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:5672
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a896A.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:1268
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:4172
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:964
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:6048
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AD1.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4148
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:3004
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B9C.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5728
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4428
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C87.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:1044
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4348
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:2908
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EB9.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3908
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:2784
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a905F.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                        PID:3568
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:3108
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91D6.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:2204
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:5072
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92A1.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:612
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a936C.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:1548
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9580.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3968
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964B.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3712
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96D7.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:708
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9774.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                          PID:1748
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4336
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9810.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a989C.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:6104
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5420
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B6.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A42.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2472
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B8A.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:3384
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C17.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:1732
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                  PID:2820
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CD3.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:912
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D5F.bat
                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:1984
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                              PID:252
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EC7.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:3564
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                        PID:2160
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F92.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:2560
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:5320
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA01E.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0BB.bat
                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA157.bat
                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4312
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1E3.bat
                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                              PID:2540
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                        PID:688
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3D7.bat
                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA474.bat
                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:700
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4F1.bat
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:5664
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:5648
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA57D.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61A.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2200
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA697.bat
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:5176
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA723.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA82D.bat
                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA985.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB03B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB24F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB358.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB50E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB58B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB627.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:52
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB859.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                2⤵
                                                                                                                • Creates a file in the Startup directory
                                                                                                                • Executes dropped EXE
                                                                                                                • Enumerates connected drives
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Drops file in Windows directory
                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1872
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                  3⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2648
                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                    4⤵
                                                                                                                      PID:3588

                                                                                                              Network

                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                    Reconnaissance

                                                                                                                    Resource Development

                                                                                                                    Initial Access

                                                                                                                    Execution

                                                                                                                    Command and Scripting Interpreter

                                                                                                                    1
                                                                                                                    T1059

                                                                                                                    Windows Command Shell

                                                                                                                    1
                                                                                                                    T1059.003

                                                                                                                    Persistence

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Privilege Escalation

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Defense Evasion

                                                                                                                    Credential Access

                                                                                                                    Credentials from Password Stores

                                                                                                                    1
                                                                                                                    T1555

                                                                                                                    Credentials from Web Browsers

                                                                                                                    1
                                                                                                                    T1555.003

                                                                                                                    Unsecured Credentials

                                                                                                                    1
                                                                                                                    T1552

                                                                                                                    Credentials In Files

                                                                                                                    1
                                                                                                                    T1552.001

                                                                                                                    Discovery

                                                                                                                    Peripheral Device Discovery

                                                                                                                    1
                                                                                                                    T1120

                                                                                                                    Query Registry

                                                                                                                    1
                                                                                                                    T1012

                                                                                                                    System Information Discovery

                                                                                                                    1
                                                                                                                    T1082

                                                                                                                    System Location Discovery

                                                                                                                    1
                                                                                                                    T1614

                                                                                                                    System Language Discovery

                                                                                                                    1
                                                                                                                    T1614.001

                                                                                                                    System Network Configuration Discovery

                                                                                                                    1
                                                                                                                    T1016

                                                                                                                    Lateral Movement

                                                                                                                    Collection

                                                                                                                    Data from Local System

                                                                                                                    1
                                                                                                                    T1005

                                                                                                                    Command and Control

                                                                                                                    Exfiltration

                                                                                                                    Impact

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    $$a2FFF.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a2FFF.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 958dab005ef0d549ba784fb6eaf08938a272d093b28c9607db0bdf0192f40f2e
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3406.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3406.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 84a0616c032348a5b3045ce9eab7281297212c28fa7885058a9dfa702433cff4
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a360A.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a360A.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 3bf72811c18273ca49a70296da00aab22fb1d44e98b85dc4be32f3866ae55049
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3927.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3927.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 bf954db0dae2fcd18d2471d3082d7305fa9fbb77d66b4cc3479c206811ebf0be
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3B1B.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3B1B.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 0110956876e540592d75d1d359425890eb1a8104104ea09c965d0f95efb8a1ef
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3D3E.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 2770ee2fbf90c827902844b702985e78f55ccb25f519e052ee2b5304cbb2c122
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3F22.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3F22.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 6c7873a466483d536c68e791ba7ff53111b323dfb0fe6f9936c21b0047d6a95c
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a4135.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4135.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 2b27da6f0973ccdf2a169e9fa6136ff4e7e523436d6554dbeffbbb12a7580bdf
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a4349.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4349.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 ae4a396444569b6b04100451b04d8a85fe7457d63a5ab0a64668b147f942e663
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a452D.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a452D.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 de8a4b4bbc2212726e2fd9fcb47dcdf47157914648b08c433ec7b826322e5938
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a4B19.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4B19.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 21141721d1122d5d119d5ccb0d7fdd51e1c9a37bd6ceaf8be85da4aa973f0db6
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a50B6.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 89a55c8837ca0e40d87cefd15955dbd189f28876653bf0f4b4d4a7f86ca1b88d
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a522D.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a522D.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 326a712626deaba5ea62cae1722d60a2c6765c0c3c0424bbb58fa2d8f259247b
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a5D39.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5D39.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 80491b5e360d324f737ab084b3cd60e6a6bc458bd6c55ec6c9b554c519760c5e
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6538.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6538.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 f46940bdab83283d0144013f6b67da72408c92b0e45bfb26018478a113ea6994
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a66AF.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 26f3f302e2f0c8cbc78e1340bcf356f3a66e401b4ad471d01a30891d6aa01d11
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6894.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6894.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 44de0efcda73594f0fa57d60994469e45c615e54f2f2e0936f1202a7a374e1d2
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6BFF.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6BFF.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 878f541ea0caa9dcb403d9d32c3bcb8cbd0eb70e4293271222c7f5637b379b48
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6DB4.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6DB4.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 91179724ec17cf3b67f14d952b858c06335dc73d6a26e626dbedbcee646e5175
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6FE7.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 a336520fbea2c0d180e3bf02b2a4ceae9a7705f54ae692492df8f53f35261c90
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a716D.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a716D.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 62bfdf6b922171e5841006f7a252b91e7d448cdf60419ae09b6884ac67cc9bd4
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.0MB
                                                                                                                    • SHA256 1dfd930557df8991561885fe168ae419621ed2309dd62834fc68664c889b40fd
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.9MB
                                                                                                                    • SHA256 990938f4fefabf1813600050232b2492b1ae1d7999fe9486e06647b4d39fb4e9
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.9MB
                                                                                                                    • SHA256 27b04455a9117c944b68922bc21f399d2fdf95374686b58975c16e307bb3bd88
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.1MB
                                                                                                                    • SHA256 383dc2fd997aa4964dc29feb863887b1cb999e1831646d2ef0b2d86a70643bbc
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.8MB
                                                                                                                    • SHA256 03a5d9ef975cffbcd6bdde7c898950c00a62142c009abf4a640c1143ddbe7aa9
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.7MB
                                                                                                                    • SHA256 e6fc8d1da970948144a07b972e3c8e8affce8219e4ae6eaf557365d84a06679f
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.7MB
                                                                                                                    • SHA256 b0104615170e59921040da51634d2d5520b6018eb2b370f11476308ef1c9f4af
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.6MB
                                                                                                                    • SHA256 da9eace4b5674f16d4d1c5533fcd4450278d7285205c4c482ff691a7262af9cd
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.5MB
                                                                                                                    • SHA256 774654efa3d8bae5e5e810bf5ea63da597a63d23259e91047e4bec2620a1d939
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.5MB
                                                                                                                    • SHA256 7db556befea763963e418ede3a6108ac211701f5b9c1ad1c215f58191435d69c
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.1MB
                                                                                                                    • SHA256 a41c1837e061d408377fb90975252ae9a38ab9c76a86b1bfd5208562ee8548fe
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.6MB
                                                                                                                    • SHA256 58cf2d8c278651f9bcba4e114fe08bab64c172ce69871e8baeaec9d1f3f986db
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.6MB
                                                                                                                    • SHA256 39ad3182c1636d55206f8d4c1c451997ec7d370386434f6195eb5c2439d2d027
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.0MB
                                                                                                                    • SHA256 a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.5MB
                                                                                                                    • SHA256 4ddc8341c647ae04dbf4839bf12625c0e40bf47ab1fa81333ecfb1872f6f5a8d
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.0MB
                                                                                                                    • SHA256 5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.9MB
                                                                                                                    • SHA256 120e6b416bd3fd3240974a493371266bdd5b49f7d35059c3b89ab746d7d021f9
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.8MB
                                                                                                                    • SHA256 7fc418a6a695ad3d13d3d76860d750a4e81716fe76ef976b94b887c6c542fdfa
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.8MB
                                                                                                                    • SHA256 c535287e825dff704574788d6cadef8423d6470d4592ae9a0d616d345ed0f5c7
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_014154867017400572fca6f9adf2a33d_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.7MB
                                                                                                                    • SHA256 480eea22f2a150c131954ce0f176969328a4be31f348a356895078b1fb11dabb
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Logo1_.exe
                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                    • Size 32KB
                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    _desktop.ini
                                                                                                                    • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                    • Size 10B
                                                                                                                    • SHA256 3f43de58fa94e2a89f2a4de2cfe5010d3cdda73cede6c826a1e467c350c87476
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    memory/8-1894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/52-8865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/112-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/364-8767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/688-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/700-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/708-8471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/820-5617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/912-8535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1044-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1060-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1204-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1248-8591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1256-8809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1280-8514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1316-8851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1324-8816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1348-5635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1520-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1576-8711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1648-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1728-6105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1764-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1872-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1872-3362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1872-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1872-190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1992-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2044-8830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2128-8634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2160-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2240-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2276-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2380-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2432-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2476-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2492-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2536-8549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2544-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2668-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2688-8507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2736-8823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2752-8858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2816-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2820-8528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2852-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2908-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2976-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2984-8802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2988-8447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3004-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3108-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3112-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3180-5626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3300-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3324-4203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3408-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3420-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3496-8739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3516-8718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3540-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3552-8874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3552-8880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3812-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3880-8872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3908-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3956-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3968-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4100-8676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4128-1885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4172-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4204-6136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4212-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4248-8725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4252-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4268-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4316-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4336-8477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4344-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4388-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4404-8760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4424-8291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4428-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4572-8788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4588-8655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4604-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4612-8837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4648-6127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4692-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4768-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4800-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4888-6114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4968-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5008-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5008-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5072-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5244-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5248-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5320-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5332-1567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5420-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5488-8844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5512-8297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5516-8351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5648-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5672-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5768-8697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5776-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5776-1876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5784-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5840-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5860-8669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5876-8465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5892-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5904-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5964-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5968-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5968-3365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5988-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6036-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6044-8781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6048-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6104-8489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6132-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download