Overview

overview

7

Static

static

3

2026-09-24...op.exe

windows10-2004-x64

7

2026-09-24...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 15:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
  • Size 5.5MB
  • Sample260925-tdlbhazfmc
  • SHA256 978d5e14ba8c7de89540f29526d72b47a4c26f5708e6ae8ef6fba16ac16e84e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD47.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5824
      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EA.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4148
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a536.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3548
              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2828
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a863.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3224
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5504
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9F.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4716
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:120
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7D.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1640
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2384
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10EE.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5588
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5480
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13FB.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1048
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2548
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D13.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5544
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4480
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2205.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4676
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1540
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2532.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4084
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4576
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D9E.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4612
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4936
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CB1.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:260
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1200
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EE4.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4976
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3412
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4368.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2896
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2760
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4656.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2816
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1484
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48B7.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4244
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3364
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53D3.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1556
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4152
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E6.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2492
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4560
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5942.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5080
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2240
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B74.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4336
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4160
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E43.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2584
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1524
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F3D.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5896
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4140
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6037.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5860
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4048
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6141.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2864
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4064
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a623B.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5828
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:460
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6315.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1264
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4984
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a640F.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4904
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5672
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64FA.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2556
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4488
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65D4.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4580
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4424
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66A0.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:2140
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5780
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:1668
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:3492
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6884.bat
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2308
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1544
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a693F.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2404
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4748
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A0B.bat
                                                                                                                                              70⤵
                                                                                                                                                PID:712
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:3836
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AF5.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:4176
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4540
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BDF.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:2408
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4772
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CD9.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:2276
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2476
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DC4.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:4744
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:2564
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E8F.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4228
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1644
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F98.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:4256
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4828
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7092.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:5756
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4204
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a718C.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4236
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:1948
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7286.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                            PID:3740
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2660
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7361.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:5468
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2588
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a743C.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:1976
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74F7.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                            PID:5332
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:2080
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7611.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:948
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76FB.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                        PID:932
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3712
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77E5.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                              PID:4720
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:3252
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78C0.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                    PID:2464
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a799B.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                          PID:5984
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:1340
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A76.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:876
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2B.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D25.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:3092
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:428
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DE1.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5548
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4104
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EBB.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:252
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:2768
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F96.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                    PID:3464
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:2876
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8090.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1252
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:4028
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:1752
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:3360
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82A3.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:3656
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a837E.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4172
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8488.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8543.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                      PID:5132
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85FF.bat
                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:5376
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86AB.bat
                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8737.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                      PID:4112
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87E3.bat
                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                          PID:5324
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a889F.bat
                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:5044
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a895A.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5688
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A25.bat
                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B3F.bat
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:4620
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1572
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CA6.bat
                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:2860
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D81.bat
                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5872
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3268
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E3C.bat
                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F07.bat
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:5444
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9030.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:908
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2688
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90EC.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1060
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:5648
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9282.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a932E.bat
                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9476.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9531.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a981F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A62.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA05D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA36A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA406.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA510.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA677.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA84C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAACD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB00C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB089.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB22F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB29D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB675.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB879.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB905.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC104.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:748
                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:5832
                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                              PID:4072
                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4928

                                                                                                                                                                                                          Network

                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                $$a10EE.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a10EE.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 7e7e4c0057de8ed4b6341ac48857c233bcf0cb9e709055c50bc0098f4c4b04db
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a13FB.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a13FB.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 916edab7fb1ae920083412e8e6fc05878048af951452c9c3e473af4dc8f513ad
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a1D13.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1D13.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 e39a3c342db5ff2f150725c4a5e50b91e811b53570df32f00bf40a1530c2db85
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a1EA.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1EA.bat
                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                • SHA256 559b9887b42c0aa05e03071be6a4ae999ffb210c1eccd964bd6a2e063eba972d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a2205.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2205.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 1c9bc8dd4f30443f54d26d09b669738d5198e8dec3870283e10ff4f07b13e156
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a2532.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2532.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 1acef248dd92cbb6fe16783bbbd476fbdec2c3bdf95f50dd9ad73380acd4f0a9
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a2D9E.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2D9E.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 0c303a769d52f2a4e6e6b94e9ac89303258127f479a37199f0c554f5491d67a4
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a3CB1.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3CB1.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 193dfd120e245526c948496bf96cac48eea348c07f71c2788f3f453defd56ba4
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a3EE4.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3EE4.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 a40438702e65814db8680085776e38bf5289d9e64f1e64d8b8232fbf99b147d8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a4368.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4368.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 69b8c8d1574dd3ce4abce919f786fc20081420bedf179f0f1b892a9f01cd3192
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a4656.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4656.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 53e16f6ad4cd664398d992af3bd697371c17f2c6f0c54c62873692737bae0022
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a48B7.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a48B7.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 2f1ccfddebe71133e3721b795e297aef42df4c62f250589d5de764adfe5dbb6d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a536.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a536.bat
                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                • SHA256 e184ee4e747e99f20db171dca47142d4f0f77703d54924ac3947aeb70cedc454
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a53D3.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a53D3.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 1c7ef7c484ffd4d24bce8f7e6ca23b4709f469b0c2990bc3a24049d290c98caa
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a55E6.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a55E6.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 ba1d0222520d95057d32aa71f18e4024e371afe0460192d9486272b1312f67e4
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a5942.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5942.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 cbd840d082a2b1c232f27c3be90daa8a02d73bbe7268ecb0a635a4e6b72157f3
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a5B74.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5B74.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 7a031bde847349076064e419105de538a135fc5d1c22ab3fb53cf41bdac44012
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$a863.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a863.bat
                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                • SHA256 3ed07f5272cf729d8d71bec675bb08228f066b6b5a8d1bca14e9458fb48d8c3d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$aB9F.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB9F.bat
                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                • SHA256 a5515981850c7f373d73b9b083ed4b83920a6b8869cfd71525aa5d467a49d4ff
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$aE7D.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE7D.bat
                                                                                                                                                                                                                • Size 775B
                                                                                                                                                                                                                • SHA256 cce824edbab38588862063871180694802bcf844fdf88f35ba20bf7ce48e40d1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                $$aFD47.bat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFD47.bat
                                                                                                                                                                                                                • Size 776B
                                                                                                                                                                                                                • SHA256 b01d9f17e563704c6c09544cfc3b272c2a9583e84d6f70a62296a0eb3e9c5491
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                • SHA256 685112347fc6f840f51756578e9d50748f17fffb96b70a5a9057e548dd35c37a
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                • SHA256 7b3c6d5fea1885b299c2ca9d9b682ab8c333e981187dbe067659d32e3da71a9c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                • SHA256 c9d850a71e2cb872a5a39c5cb98634feb015921f25953b75b2e855ccef539507
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 627593003d245bb73da61e645a7b5e11f746302f03ff442041f4809438c58bcc
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                                • SHA256 6f3c040624e770bb4769917cf0dcb3ce0ec1049702e4c7233c3b6d1f7b0c67fa
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                • SHA256 bfb5667745cff72f90bddbfe09c45746bd51963c5d22494578a05bfd1b559c0d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 839466309e57773b92e89e560bf259af757983d92f8e158670a062bddb527d2f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                                • SHA256 4cf1c7b6e565ee357f7948ea88ae0026b3a22155c425e582344d24ca755b3483
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 61ad05ce6e659d8651f1be8e608885115e16f8299d7e400cd9b7e18ce8e1435b
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                                • SHA256 3c22e3687e8d7a4f433458bb574a0fb83e83e47cccb3f3b14a1043a775a11144
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                • SHA256 072a3857547757a7670c12155bb71f40a7782bdc532e4be52dc286a7eef4ec88
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                • SHA256 e4f53e812d09d90f29340a21721bec6fe0b25ab41130db8a8c0fcd1982990184
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                • SHA256 5595bf7522cb69e2ec2757e2854ac7ffbcbb99573643de8b9ebea9ce45f62449
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                • SHA256 bad66172911a2fa0298486809c6d39253a8b494e8aadf816e3602cd035e12b50
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                • SHA256 0eaf6e0c80b5984bb2edb56d4986b611f20479f0d5992e3075bbffc19f590a5c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                • SHA256 b0d9dff6edef505b4f187894ec01571488c72daf5203598e80bedbf3ef23433e
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                • SHA256 f8a1d16dee39c57ec990d82398cc875219b7f1824569229de210f4c537217232
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                • SHA256 e039917821d620efe7f9eb989d1f21b36120b1149eb37de75ce549f689716d28
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                • SHA256 d375401fdb07bc0c9410692e05c8f1adb89607507407a60f57650078a009a0ca
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_03b5fbec64a496850740b39f1e64a482_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                • SHA256 24f0ea2abdbbdc298c24b68d8cc6a374969fc6831ace2a96c532f17e1bce81d3
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-2304238888-3968896904-642854331-1000\_desktop.ini
                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                memory/120-2546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/120-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/256-8729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/428-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/460-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/936-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1164-8957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1200-5592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1208-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1232-8945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1252-8434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1320-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1340-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1380-8747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1392-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1484-6081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1524-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1540-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1544-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1572-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1644-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1652-8687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1704-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1788-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1808-8657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1940-8759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1948-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2004-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2016-8675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2024-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2080-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2120-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2152-8969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2240-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2384-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2420-8951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2432-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2476-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2480-8981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2548-1141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2564-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2572-8663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2588-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2628-8921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2660-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2664-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2688-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2704-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2760-6069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2768-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2828-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2840-8897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2844-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2876-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2964-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2968-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3048-8915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3236-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3252-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3268-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3292-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3360-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3364-8211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3412-6061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3432-8855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3492-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3500-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3616-8963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3712-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3764-8987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3808-8723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/3836-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4036-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4048-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4060-8837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4064-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4104-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4112-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4140-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4148-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4152-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4156-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4160-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4172-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4184-8717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4204-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4248-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4264-8933-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4272-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4296-8693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4316-8873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4328-8909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4332-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4384-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4392-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4424-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4468-8867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4480-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4488-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4496-8633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4512-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4540-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4544-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4544-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4560-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4564-8735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4576-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4604-8711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4632-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4664-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4700-8939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4704-8885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4748-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4756-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4772-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4780-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4792-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4800-8861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4828-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4840-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4852-8651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4856-8891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4884-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4932-8645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4936-5584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4952-8813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4984-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5012-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5032-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5044-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5216-8927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5220-8669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5272-8879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5340-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5372-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5444-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5480-101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5488-8843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5504-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5592-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5596-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5628-8705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5668-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5672-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5684-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5748-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5780-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5832-6372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5832-939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5832-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5832-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5832-1861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5856-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5904-8903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5928-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5972-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6000-8819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6012-8975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6088-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6100-8801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                Download