Overview

overview

7

Static

static

3

2026-09-16...op.exe

windows10-2004-x64

7

2026-09-16...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/09/2026, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
  • Size 5.0MB
  • Sample260916-wcp96sdr21
  • SHA256 e675869219521500ce486d8795f3a623f6bb1be643c8bd9970b7248a3e22a14a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE9A.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0AD.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2940
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB438.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4728
              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3256
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB85E.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:808
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2328
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADF.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3052
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5084
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDCD.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:228
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1128
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC09C.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3936
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2888
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC32C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1956
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1056
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC520.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:760
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3880
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7B0.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4476
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3708
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF9.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3772
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:6664
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD30A.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:6796
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4216
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7BD.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:556
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4580
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA3E.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1800
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3924
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD3C.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:6696
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4860
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1FE.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5184
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5600
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4EC.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6808
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:312
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE932.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2196
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5820
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC11.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5544
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:6564
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEB0.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1096
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2968
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF121.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3100
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5636
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43E.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:6940
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1564
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4CB.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2416
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1616
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF548.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6800
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4224
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5C5.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4120
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1224
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF652.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2276
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3308
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6BF.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4252
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:900
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF73C.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4980
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5852
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7B9.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:816
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1572
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF846.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4744
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4944
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8F1.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4344
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3964
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF98E.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1740
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4440
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA0B.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:2240
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1236
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA97.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:552
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:948
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB43.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:2380
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:5696
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBDF.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:5736
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:5788
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC8B.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:7056
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:6372
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD85.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:6576
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5132
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFECD.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:5408
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:3264
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2320
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:5772
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a110.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:6104
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:6632
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a229.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3808
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1704
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a381.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5504
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:5580
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46B.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:432
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:812
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a565.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1232
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64F.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3788
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:3368
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:5616
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a853.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AB.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:3260
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:6268
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:7144
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:6452
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6D.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5360
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1296
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:7060
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1071.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:2480
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:6216
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10DE.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                              PID:6200
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11AA.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1227.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:6120
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:6188
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12A4.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:6248
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:7092
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a141B.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                PID:5540
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:6296
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14B7.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:6300
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:6344
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1592.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:6380
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2256
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a165D.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2560
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E9.bat
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:6668
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5752
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1795.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:6744
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                        PID:6616
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1822.bat
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18AE.bat
                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:7072
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a194B.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A25.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                  PID:2584
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AF1.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:6444
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5828
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BBC.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:5728
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                            PID:5160
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C58.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                PID:5192
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                    PID:5264
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DBF.bat
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:2768
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                          PID:5428
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EE8.bat
                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                              PID:6508
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:5348
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F65.bat
                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2040.bat
                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:7140
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5684
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20BD.bat
                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6700
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4000
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21E6.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7000
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:5632
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22A1.bat
                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6896
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:448
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a238C.bat
                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:1724
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2457.bat
                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2541.bat
                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a267A.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2745.bat
                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a285E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2968.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A71.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B0E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6716
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6456
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a301E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3241.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3493.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3520.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3639.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3752.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a381D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a388B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3917.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ADC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a408A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4155.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a423F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4349.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a457B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4666.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4721.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a480B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4963.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6676
                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:728
                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:1812
                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:4676

                                                                                                                                                                                      Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            $$aAE9A.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAE9A.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b79285b9d86daa7e009914cb8091cff9de5400678b5e443280a32ced354957f4
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aB0AD.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB0AD.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 ccc33309b864d83bfc6752ba7c5d49b1c00bdb0c728777e921c80020d60d68d0
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aB438.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB438.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 f375c274f8ea845826b702237a5685777e06116c0e5c100f7eabd1e5d0771757
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aB85E.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB85E.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 25572bb9add9fa751d478db3c7bec37d73d1880477e51a8c019365c90489fc15
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aBADF.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBADF.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b208df716e6731cbad4e641c57e03b4aec481e74ccdd792fd5ed7aa63c1a9a7d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aBDCD.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBDCD.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 f71a8e427393ab744d12e0ef40fff5e81c1d196259c6d5ca859aefa477f9af20
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aC09C.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC09C.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b23073a8a18c9545f0889c5fe1310257400a7c3e9690bae04401c19a403de509
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aC32C.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC32C.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 75f3a3570003fc88129b959e4734bb7da9e4b9cb513569ed1fce3d87e63143bf
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aC520.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC520.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 344f6d625809c40cf4b9fcfe2e25887bcbbb5ca05dff99fa3fc7f0431fdc6620
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aC7B0.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC7B0.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 a5703fc03b71d4e138ebfcd5376931c7b361b166f4b76c21fe37f1999c17bc50
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aCDF9.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCDF9.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 f83ffa04ee9c02d8182c4c8c8a5dcfb8ee66e4bb5d3c3ac6685264dc3b028b9d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aD30A.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD30A.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 e4b2137bb7dec9f5fe84f082fd66b066cf94c7987e9c74a7b4cfcf4c2a17a29f
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aD7BD.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD7BD.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 93173ae999a606f8b9959294489a2d705e699cc671c656718b19b63379b37bc3
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aDA3E.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDA3E.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b071cc25a12674a4a8448c0b0dd2565003bde1d8b67de7cd6a7f1cd8fc7b9ffb
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aDD3C.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDD3C.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 058d60ceed2cc70567a487e458fc2f3ab53287e6747deae717823c64c18b34a5
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aE1FE.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE1FE.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b5d89be7b986af48c5df71adc3bf263abc81c5f16573d9d9bb8c76a18789e658
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aE4EC.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE4EC.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 ec1019bfca947bd23fb137101936997fb529469053a1ad00cc55a7cff73f0e67
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aE932.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE932.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 e78fee4229a862bd1fc75f3dac965de4f0a3a280dbae06c1286c1a8b26184aed
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aEC11.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aEC11.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 9e562c29847a7286698f36b05ba5d9a92428e3eb1c5836dbcbf5f782187ac164
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aEEB0.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aEEB0.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 a835b38653965169607ac735d96161caa9d2897e2903e1f58ea62c358d8e07b8
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF121.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF121.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 75dac505cf9a6f8aa7169b65b830c4ba571b67ad30e5deaf01ea1a7f1a5e208d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 d61d30642c93e8e80082ded6aeaea28c681f8da10560424fabdf95c3fa06a686
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 ece8d3bda9b0185ecbc0edc3f63d9f2fa58aeb871bb27eea1c63f20130408155
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 99210adafbfbc2a92f1b48fa9268b860ead339ba902794719053ca9d969ad407
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 091ba41b1447e32a6d3b6db57b8f5c8f4d76d688da931a2c56ed63fd66f2ff09
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 cc70f1dbdb60d2984affde7f9f6f1cb2bea0fdc69a8102caf5b1da6d85832b8b
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 40e16a47eea2b57c7f80eb6579b543e486d8121496dbaa9802443119598066c7
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.5MB
                                                                                                                                                                                            • SHA256 61502cb58cae9abd0b3445d9dc54e5ded76a47fee27dffd621a3e5b0410b739b
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.5MB
                                                                                                                                                                                            • SHA256 3cfd4c93b359be8020a74dfc357bab54fc897be70382f13172fd728a7bb299df
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.5MB
                                                                                                                                                                                            • SHA256 c59c4e5dbf0f6dbbe711c27149a15f11f6a4f42e6e43573ea3f974805e770e41
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.4MB
                                                                                                                                                                                            • SHA256 2de0f3948bcb14d95b0a3fec7357c3c829022476ac6f9b56428cd41f5ce32f1d
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.4MB
                                                                                                                                                                                            • SHA256 5559e32244501e3fa79d0f16be7409426cc529469198ba2e5dd0a91c95df7dea
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.3MB
                                                                                                                                                                                            • SHA256 1159992d800315286bdea12f908f62ad5987fc32681cb79edd537f94d1d10e24
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.4MB
                                                                                                                                                                                            • SHA256 c4ababa1ff40232f19622c6d0d146fd65ed3e317a0ec91295e2c8084e512ce79
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.3MB
                                                                                                                                                                                            • SHA256 5797f8335cdb0cfb428fec1c7e59b6b475e8730117ca6228101efc89a28f1a1c
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 101b99f165a4f68549a4b98ea4a1072941a71070de0f4622645fd44613ba20c6
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 5945bcf64dbc16d43ae32481ac43f0953293f15d576c8c993d5bb5e016047276
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 e74ab29abc83537faf4c9f4814a7efb1ff00993d5cc7f53553cee7b4467e8d4b
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 6bd5582169c34eaf16b183262336e46d74a5524a8f929ecbd7d76c001ce51ef8
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 094a43942b8ff248cdd01eb6ec6000cea7ba9146bd53639159dda28db2aeade0
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_b7892ca835acf173f4dbfd5d916d1c27_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 cd978d8690fcca176c4f2e92f64f0d3fa7f875008f19107e823ac4de5212c808
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-895009113-1202185046-1686627690-1000\_desktop.ini
                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                            • SHA256 adce21c38863e3719070b76cc57d41c4a6461464168032427c8b59beb6ce354c
                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            memory/216-10558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/312-5511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/448-10262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/516-10548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/632-10202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/728-140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/728-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/728-6395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/728-2565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/812-7722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/900-6156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/944-10313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/948-6188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1056-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1112-10418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1128-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1224-6148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1236-6184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1292-10283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1296-9962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1404-8089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1564-6136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1572-6164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1616-6140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1704-7419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1724-10268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1764-10493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1864-10303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2252-10438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2256-10178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2292-10579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2292-10574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2328-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2348-1850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2348-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2424-10333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2560-10182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2584-10212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2888-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2940-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2968-5863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3024-10503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3108-10273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3256-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3264-6813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3292-10278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3308-6152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3352-10458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3616-10393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3648-10473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3708-1856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3740-10483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3780-10553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3880-144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3924-5035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3964-6176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3996-10518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4000-10252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4040-10443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4056-10563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4108-10298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4184-10403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4188-10463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4216-3025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4224-6144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4272-10288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4360-10398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4440-6180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4464-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4464-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4520-10538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4532-10308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4548-10242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4580-3624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4592-10207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4628-10197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4756-10568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4860-5171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4880-10533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4944-6172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5084-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5132-6612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5160-10222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5216-10408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5260-8487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5264-10227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5284-10413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5348-10237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5372-10293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5428-10232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5460-10488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5476-10323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5484-10318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5560-10573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5580-7567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5600-5280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5608-10453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5616-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5632-10257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5636-6121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5684-10247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5696-6192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5700-10513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5716-10498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5752-10187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5772-7109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5788-6241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5796-7925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5820-5610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5828-10217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5836-10508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5844-10468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5852-6160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5988-8663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6004-10523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6008-10154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6040-10343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6072-10348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6080-10158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6148-10353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6176-10543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6188-10162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6216-10150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6256-10528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6268-9031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6296-10170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6344-10174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6356-10363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6372-6443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6432-10338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6452-9731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6480-10383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6524-10368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6552-10373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6564-5820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6596-10433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6608-10428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6616-10192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6624-10448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6632-7281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6664-2419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6716-10328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/7032-10388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/7036-10378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/7060-10146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/7068-10358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/7092-10166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/7108-10423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/7160-10478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download