Overview

overview

8

Static

static

3

2026-09-24...op.exe

windows10-2004-x64

8

2026-09-24...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
  • Size 4.6MB
  • Sample260925-ppk3nassds
  • SHA256 73891ba927dcf7d9d07f126a166836552befa90848eb1fd511f23c5e15db0b52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a264B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5988
      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29A6.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3432
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EE6.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4896
              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4864
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a336A.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5416
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2108
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a380E.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4900
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:1588
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4711.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4840
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1268
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A0F.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5148
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:800
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6018.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1080
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2524
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6344.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1752
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5856
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a697E.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5232
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1172
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2864
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2288
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8F.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:968
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4188
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FF4.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3944
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5432
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8459.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1816
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5452
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88BE.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3300
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:480
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D13.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3648
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4712
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5364
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2792
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a959F.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5940
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1156
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3848
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5768
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2576
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3616
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA54E.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4576
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2944
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1540
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4120
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4A.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3768
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5368
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC92.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1796
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1144
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADBB.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4000
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2036
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAED4.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2100
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4544
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4828
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3700
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0E7.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1400
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2144
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3440
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1376
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4780
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2908
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB443.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:5680
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5508
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB54C.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:3292
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:2976
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB665.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:5860
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2748
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB78E.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:5156
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5200
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB898.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4196
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3580
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4236
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4948
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA8C.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4336
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:4784
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:4484
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2476
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC61.bat
                                                                                                                                                                78⤵
                                                                                                                                                                  PID:4752
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5980
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:5104
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:704
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE74.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2668
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:5356
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF4F.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                                PID:6080
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:3388
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC049.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                      PID:200
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:5892
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:5268
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:120
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1FE.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:1408
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC327.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:2568
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:2396
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3F2.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                          PID:2936
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:5040
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC51B.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:6072
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:5764
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC625.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:1712
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4668
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3340
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC809.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:1112
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC913.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:4220
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9FD.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                        PID:560
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:3096
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:1956
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:2752
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBD2.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:5172
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC8D.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5684
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD39.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE24.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3920
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:3732
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEFE.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:5544
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFE9.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:1344
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0E3.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2104
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1BD.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5228
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD298.bat
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:5004
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3A2.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:1428
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4BB.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD596.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:244
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD661.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD72C.bat
                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5412
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7F7.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:4924
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8F1.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:1832
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                            PID:4488
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9BC.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:5284
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:3736
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAA7.bat
                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB72.bat
                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                        PID:3020
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC4D.bat
                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3812
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:4692
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD37.bat
                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:984
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5492
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:956
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF0C.bat
                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4116
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2372
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFC7.bat
                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2072
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:5392
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1EA.bat
                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:1964
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2E4.bat
                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5656
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3CE.bat
                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:832
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE68E.bat
                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE7D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF052.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF18A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF274.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF36E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF459.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF534.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF708.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB7D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a234.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a408.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a939.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC46.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                        2⤵
                                                                                                                        • Creates a file in the Startup directory
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Enumerates connected drives
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1352
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                          3⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4372
                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                            4⤵
                                                                                                                              PID:5104

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            $$a264B.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a264B.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 6303f94e32987b3ccb41afb66b6ddb45586c2f2de0f3d73194348cce432d2425
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a29A6.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a29A6.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 25f90adfff6d628dc6b1a7525da5f2f53a2a7d83a57651c7e832991bfc34ac94
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a2EE6.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2EE6.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 41494b668f019919ac44db62a17f81530f61313c6cd5527994b41811f5ccc8f6
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a336A.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a336A.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 11fd3861548c3f3d73f0a3a10931ca5b4e7688336b325e8cb8dfa3b486babb34
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a380E.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a380E.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 050ec38616ade8174bffc2c3d0112bab25c8fcbd4c64f2e862a3526aeb04d8be
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a4711.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4711.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 93bddec6341ae3299baa2c0fe790d2fa59320188fc9a6d007d45ee11f6b88ae2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a4A0F.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4A0F.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 48b8e17267d88a661cf333a61dd61b74f09f95192441724ba9d185f6fd34790b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a6018.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6018.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 dc5397234fe8cd252f94d3b21829fa4afaddbbaea2bd0c67e5d1a1f68cda5ac5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a6344.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6344.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 f7d24362a4492ceef3ecf7b45f716733b1e2da3add1d21d9c71e96286eb13556
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a697E.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a697E.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 e23301bbd51d7e07e1c741b12008220828426987811d86a078ffd2854d8bc995
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a78B1.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 cde17b544c43b40ba2e0da8777baaf59f1c9ecc165e42cad5ebf0d4084553ea2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a7B8F.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7B8F.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 2db19b940f2c08557c8123d88a3f543d2fedade199eac22173b185ec5809c99a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a7FF4.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7FF4.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 017ab7f10fba4078111ef2f006bdc0528b51bc3fde41e9dae90442799ddb911f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a8459.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8459.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 d7b3d30eb99f47054d10d9504c55827949f30e14b03a5291332784417db0de69
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a88BE.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a88BE.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 93894bb5ae42712bba0f75c281ece97d14acf0f718f638a0fb40e11a1067d113
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a8D13.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8D13.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 d4b4a6276985037102b4d3bb4ab858d4483425b9327299f4cdd9f62b8a0987bc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a9198.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 117f9792b6184f354faf1840adb816d6acbe4efd935f388755beaf4f1d011c35
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a959F.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a959F.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 81726b7b31fcb54a2fbd0a9ea0959319faea0145cd0f30ce2f0a03f5adf7abbf
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a9A13.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 6221868baa7be998f2bbdf99344eb1e729bb3164f8f76f2ee9656aef11723bad
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$a9FA1.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 32530c90685202ea09a964697b19c659a1d2191e525ea858c7c411856352c6bc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            $$aA54E.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA54E.bat
                                                                                                                            • Size 776B
                                                                                                                            • SHA256 06991dbcb2a7edbd04de7eb3680c09d330ea3ee6619726aa332ac3f391bd122e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.3MB
                                                                                                                            • SHA256 e9a2c05aad484a75da569d447a20b4165287b5a18601c50ea89367f2c0308591
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 85d69b2d32fadc0cdfd4afbe775b63e82b3cad701e6b63debd3627044a699f1f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.0MB
                                                                                                                            • SHA256 4d8383021ad7ecbe429e606db33a66e002b1565940e789b20e8b67643b5b7e0f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 b9dff88fb28424d49274033082298c8e4b24f93750928befc45abd4d11823565
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 503ac569ea79f127d23d614472130830abdde03a0c6867395c0e80cf3efd9823
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.2MB
                                                                                                                            • SHA256 62177f3e8517a49e0c6c1bcaa61c258d7b64662ca2264ac9ee78701a6673659a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.1MB
                                                                                                                            • SHA256 69381d829b74d6d3ba7812a8fff61e5be559a5c3a273f4a7f5d23c42fdd5f78c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.4MB
                                                                                                                            • SHA256 920a967707e541a0fa26dfd08244ceb4fbacb60002c4f004aaab66ec88071970
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.1MB
                                                                                                                            • SHA256 70bbc2f171a8e7cb537f84c9430f5f3a1aa4e7bf34dc4879faf283784cd0027a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.0MB
                                                                                                                            • SHA256 c1152892875ed49ab893d36ab8de0860d06dac3c238acbb0c479ec25402d4f68
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.1MB
                                                                                                                            • SHA256 c5105ac6701b1b2b4168923a9edcbaed9267fadb8c5990cc2c42912f5104e6d9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.0MB
                                                                                                                            • SHA256 2a35a7f530dde91223927b3b1f853c2ad6c8f084bc425ed98e55853868043e25
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.4MB
                                                                                                                            • SHA256 4faa04a8c72a9f077e9dc2c15fa16e3848892013042870e8d4db44eac2a92bf1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 3.9MB
                                                                                                                            • SHA256 edcb2eb1230b4487b1aabfaf7abf70790372d2033dd3861d23f8509e1f3b24c0
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.5MB
                                                                                                                            • SHA256 08178ce97a0b8088f37ce2ed98c6dabbc9b42c379f35ef05e17ca995c4a16bbc
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.5MB
                                                                                                                            • SHA256 1844dc61f0520be792fe97156cea0ad799d368bacaef404d13949a2635c566e5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.5MB
                                                                                                                            • SHA256 e036579bbe7a5638806523f17eb97eff3d868f1278c09dd3a228214b4fef694a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.4MB
                                                                                                                            • SHA256 d80c9c85e79b6649cfa23621cdbe9612848e0b513d14a988cf8ba4edb4a9469e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.3MB
                                                                                                                            • SHA256 e5dacf14e991de0046057043e8d36b4808528073f651f32b5f20ebdd0f79ad85
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_310ebd89a4534e6837c6205ba25e0737_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                            • Size 4.3MB
                                                                                                                            • SHA256 28a4cadee8448a2edbcbade84abb10e8df1164344ee1fb29c47559121c56b40e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Logo1_.exe
                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                            • Size 32KB
                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            _desktop.ini
                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-2251218687-1689653882-3767565116-1000\_desktop.ini
                                                                                                                            • Size 9B
                                                                                                                            • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            memory/8-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/120-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/244-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/480-8052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/704-8195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/800-5543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/832-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1096-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1100-8451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1112-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1144-8115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1156-8077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1172-8010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1268-1897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1284-8711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1284-8705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1316-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1344-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1352-2501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1352-1387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1352-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1352-8079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1352-7284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1364-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1372-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1376-8140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1408-8221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1416-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1428-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1464-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1536-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1548-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1556-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1588-1825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1600-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1624-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1684-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1864-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1964-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2036-8120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2104-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2108-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2144-8135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2288-8018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2372-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2396-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2476-8185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2524-5551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2656-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2684-8463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2748-8160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2752-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2792-8064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2792-8069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2820-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2824-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2880-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2904-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2908-8145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2944-8100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2952-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2956-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2976-8155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2980-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2984-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3084-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3096-8261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3100-8457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3148-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3248-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3304-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3340-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3388-8205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3428-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3432-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3444-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3444-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3580-8170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3616-8094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3700-8130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3704-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3732-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3736-8361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3844-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3880-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4120-8105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4184-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4188-8028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4200-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4216-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4220-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4304-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4344-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4348-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4408-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4448-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4488-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4544-8125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4600-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4668-8241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4684-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4692-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4712-8060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4728-8391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4784-8180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4788-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4820-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4864-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4948-8175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4988-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5040-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5140-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5172-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5200-8165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5228-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5356-8200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5368-8110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5392-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5432-8036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5452-8044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5492-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5508-8150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5540-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5544-8291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5632-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5644-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5656-8421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5660-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5684-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5764-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5768-8086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5792-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5820-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5856-6020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5876-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5892-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5972-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5980-8190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                            Download