Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 03:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
  • Size 5.0MB
  • Sample260930-d6a38sthka
  • SHA256 695aa1b1f86a652536643d9f39157836ada8090a5c0901ada0658b49e5bf35e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a384C.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5148
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B79.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3880
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3284
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E86.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5716
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:352
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4135.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5660
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2824
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4414.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2496
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1340
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4666.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5912
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4904
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4915.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1644
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1092
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BA5.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3392
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2468
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E07.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2356
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5836
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5951.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2400
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5380
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B07.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4384
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:1444
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3516
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3648
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6603.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4144
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5184
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68F1.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5096
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1924
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B53.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4160
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5528
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E21.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5472
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1112
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FF6.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5868
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1920
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7258.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2268
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3068
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B9.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:436
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2052
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76BD.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5812
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1928
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77B7.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:800
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5468
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7891.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4376
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1140
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a797C.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4344
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3472
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A95.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6016
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4240
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B70.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4432
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1760
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4A.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1532
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2092
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D06.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3460
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4324
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DF0.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4156
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:460
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EDB.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:720
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4072
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD5.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3812
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5972
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80AF.bat
                                                                                                                              62⤵
                                                                                                                                PID:4400
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:3012
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a818A.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4552
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3076
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8255.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:3296
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3196
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8330.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:2796
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:260
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a843A.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3288
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5740
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8524.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:2724
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:360
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85FF.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3748
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2684
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86DA.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:2132
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4468
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87F3.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:5416
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:1860
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88FC.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2084
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:6008
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3400
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:6140
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B2F.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:1068
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4116
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C19.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                          PID:5240
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:1904
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:5568
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E0D.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:2532
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3672
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F17.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:620
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9030.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a911B.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91F5.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2716
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92FF.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                              PID:2124
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:940
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:956
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5796
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94A5.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:3548
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a963B.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4080
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9725.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D1.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3340
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98BC.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:296
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99A6.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:2948
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A52.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:952
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B1D.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C07.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CE2.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3264
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D8E.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                    PID:5708
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1360
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E59.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:5456
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F34.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:724
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FEF.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA09B.bat
                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:2104
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA147.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1F3.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:2628
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:5052
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2892
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA36A.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5064
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA406.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                              PID:1964
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4B2.bat
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6084
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA55E.bat
                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:5692
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61A.bat
                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1020
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6C5.bat
                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:3676
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1504
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:4076
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8E8.bat
                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:5564
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1992
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA994.bat
                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA5F.bat
                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5460
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC82.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB24F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB30A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB54C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB675.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:96
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB879.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC22.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC068.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC133.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC385.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC421.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC615.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC857.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE62.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD008.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD085.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD121.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2088
                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:3736
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:5376
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                        PID:2676
                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:4268
                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:3172
                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:1392
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 980
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:5200
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4268 -ip 4268
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3548

                                                                                                                                                                                Network

                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                      Downloads

                                                                                                                                                                                      $$a384C.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a384C.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 abb3e12e9b8722012196a0fc081b2419dfb7ec00c9ef89aa68cf5a573f4fc7a2
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a3B79.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3B79.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 c874f18f7723b24013b1efd152e69b9dc591840cbd4fc094221e79cdc49e56ae
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a3E86.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3E86.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 0efc5453104f9e22173223881f68ea2b8b95ea6c081a95fd99ffd5dac0fac8ce
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a4135.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4135.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 634d2704593a440c2a808f1bc2d36fb774e602678fecf4fdbfdf6e71dbc85657
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a4414.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4414.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 81177d62942c465593f3faceb470d338c3d7312148195e67cbe69e5f1b287101
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a4666.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4666.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 d00f29dd28c52cb30927423c94ea94c2798cb250aeb660c6715a14b75e3d711f
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a4915.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4915.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 7807f737cedd759bd82d8c4dd585e3c1af78f0bb19782d6efc0936fa1ebd008f
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a4BA5.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4BA5.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 45349f475643e308fc74d86c8cc349eef314d88fb39ba97ce2492020450befa9
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a4E07.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4E07.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 9a510107db918e43e37805143a005657c669a08b8e18492f72c83382e01d4535
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a5951.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5951.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 7cf111e8c9d111175786f0c4d14a58cef21371e8b7ca72742638f45726f5d66b
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a5B07.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5B07.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 2812fdf66289d328c8cfadde4e25454008e25c02a1b383628c2e1dc874dff1cb
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a5DA7.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 ea847290bfda11ee42d8c8652469ab0c3792b25cbca06ad5babef8b9087eb092
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a6603.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6603.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 b484395b5e9b7c1cb278bb06d2c5231ada3d196001830ac002fdd29efd0fc8b2
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a68F1.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a68F1.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 03c46f6fb87d0539e24d8df46cc9b93f37d6cf75b83040b86b551a05aaf79b85
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a6B53.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6B53.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 c7361f690ea8a7ff0c34d712db85a333e273a59b3dfa45308448ebbbf31b54af
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a6E21.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6E21.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 8da794fb8e2392776f634ab07cf4149e338e6fb54a1927f75b241114e006e1d8
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a6FF6.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6FF6.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 07886041254d779e5e3f1efe699cb23a152b9add4d1b9fb7795db7eddc56026f
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      $$a7258.bat
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7258.bat
                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                      • SHA256 f03e744dcb7c38a005ca4a48aaa4fb2a475982f2479ef8f1dfa9c3df94680765
                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.5MB
                                                                                                                                                                                      • SHA256 2b146eb1d3bddfc2eb0640ec6949d8e667bae82ade509c3ac51a671fe51cfc2f
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.5MB
                                                                                                                                                                                      • SHA256 d7f94ea8032ea861446acd7a4d96e8ec39ea9995cfe4c66ae0a0788952758d10
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.6MB
                                                                                                                                                                                      • SHA256 a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.6MB
                                                                                                                                                                                      • SHA256 4e0935158509a291ef785896078919b227d731006297a8cf3b5a1866f5626f45
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.4MB
                                                                                                                                                                                      • SHA256 aa9fe1ad29d432caed281136e29aa6e69dd51934a14a752b214b9635db474880
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.5MB
                                                                                                                                                                                      • SHA256 f1b5a67a5e6d40c5540b2b4fcf43b4fc2c03f3467d40e819b700b9b662206aa9
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.4MB
                                                                                                                                                                                      • SHA256 b7e639c2a17fa6f6b1735b82472c27efd961fedde35c972a2536935e3995206e
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                      • SHA256 cfbd1a82907e91174483ff8f15156e1f1a9656f1b2557ed645d5e9795971ecda
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.4MB
                                                                                                                                                                                      • SHA256 7f9861ae12061acfc3dc042fc5a8aee9d0a0d54e204c5a7192b577090a702cfb
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.7MB
                                                                                                                                                                                      • SHA256 a3389ed66a65cab01c7e9abdca0baa4808dccbfe518a37e09d2920d3fc97b51a
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                      • SHA256 1cc1c23a14fe7c5e7d60d9802a3e3cf54484fdcb04e5696b2c87997c6b1a8975
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                      • SHA256 5ada9551d77ed2916ffdb41303633ab75632fbe1af4b9863eb5a1246297a5173
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                      • SHA256 31bbb9e0b7da1491a375c1e1e9da3b62789b9ebf40a85978182202020ffacda7
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                      • SHA256 b44383536e43d3b4f8ca09e2d51684f719416cbbe6d0fbf0ba4d8098074833c7
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                      • SHA256 42e4687b38149932ca6cdca4420380aecf041e27dc1702e5b01b4a9a3b555a10
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.7MB
                                                                                                                                                                                      • SHA256 e977aba8ddecc91f0accecc905d11e94cf51846d94aeb1e8cb4a15bf74bb7c4b
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.7MB
                                                                                                                                                                                      • SHA256 1558b3c5a10b63c1fea9c01b93a94d7486b25fd25fa03d60e8fd13d2d482858a
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_2ecd89c84c7ac5ea9101622d1cb702d1_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                      • Size 4.6MB
                                                                                                                                                                                      • SHA256 2c7c39372f4646630bac43f58e7c8985d07f874cd87c51550e0998280bd3571d
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      Dll.dll
                                                                                                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                                                                                                      • Size 68KB
                                                                                                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      _desktop.ini
                                                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-1704430598-3087477806-3297458608-1000\_desktop.ini
                                                                                                                                                                                      • Size 9B
                                                                                                                                                                                      • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                      Submit Download

                                                                                                                                                                                      memory/96-3547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/260-3182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/352-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/360-3192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/460-3152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/724-3336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/928-3739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/940-3263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/952-3303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1020-3396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1036-3372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1052-3583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1080-3534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1092-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1112-3082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1120-3426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1140-3121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1148-3504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1204-3649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1224-3248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1340-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1360-3324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1444-1913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1448-3589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1456-3697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1476-3553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1496-3540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1500-3432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1504-3402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1760-3137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1788-3468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1860-3207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1888-3516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1904-3227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1920-3092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1924-3064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1928-3111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1932-3342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1964-3378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/1992-3420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2052-3106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2092-3142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2104-3348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2108-3679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2160-3763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2188-3727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2296-3474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2348-3691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2364-3793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2408-3595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2416-3673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2444-3775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2468-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2516-3559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2564-3613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2628-3360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2656-3787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2684-3197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2716-3258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2824-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2856-3444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2892-3366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2948-3298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2976-3757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/2992-3308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3012-3167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3068-3101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3076-3172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3196-3177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3284-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3340-3288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3352-3703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3356-3751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3384-3667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3428-3408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3436-3462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3472-3127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3544-3438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3648-3038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3672-3237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3736-3243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3736-3122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3740-3242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3752-3253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3816-3631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3872-3769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/3888-3709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4072-3157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4116-3222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4128-3733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4168-3715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4228-3528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4240-3132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4256-3643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4268-3041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4268-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4268-1269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4268-2554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4324-3147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4380-3655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4412-3781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4436-3522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4460-3278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4468-3202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4512-3625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4548-3619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4568-3456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4600-3601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4636-3283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4672-3661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4772-3721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4864-3293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4888-3577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4900-3414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4904-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4916-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/4916-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5004-3607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5100-3794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5100-3800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5148-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5184-3053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5272-3273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5360-3384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5380-3096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5380-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5388-3637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5456-3330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5468-3116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5528-3072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5568-3232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5584-3450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5620-3318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5628-3354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5692-3390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5704-3565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5740-3187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5784-3313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5796-3268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5836-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5840-3492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5872-3685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5948-3480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5960-3498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5972-3162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/5992-3510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/6000-3745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/6004-3486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/6008-3212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/6124-3571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download

                                                                                                                                                                                      memory/6140-3217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                      Download