Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
  • Size 4.5MB
  • Sample260930-dfwx1sxthy
  • SHA256 bb7ff7068470d3d900fa2a4adb3fa8a1134ec94dd28c26e6215d791b008fec10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA766.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6056
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9D7.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3532
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5744
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC68.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2564
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4684
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEC9.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5616
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:6120
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB244.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:940
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2036
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB570.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:6116
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1440
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB86E.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:432
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3996
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAFE.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5384
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:3388
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC09C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2472
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4188
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2CE.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1332
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5128
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC668.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4540
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:1176
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC985.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1520
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:112
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEA5.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1292
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4584
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFDE.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6000
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5584
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD358.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5500
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5536
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD675.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4848
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5424
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8E6.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4852
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3024
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC03.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5140
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2040
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE28B.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3148
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1752
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE598.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2604
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5932
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE886.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2924
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1780
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB74.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3900
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5072
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6E.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1708
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1924
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEED0.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:760
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5736
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17F.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2404
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2076
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF279.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3224
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2808
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4BB.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2348
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5372
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF642.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:440
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4112
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6BF.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3784
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:208
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF73C.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2612
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5972
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7B9.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4764
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:900
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF865.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:1264
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5964
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8F1.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4872
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:3804
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9BD.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:812
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3424
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB43.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:3356
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3908
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC5C.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:2392
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:3192
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD56.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:1240
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:2536
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDD3.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3808
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5236
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE41.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:5816
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:5588
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEDD.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:4864
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:5488
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF89.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:2140
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4464
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:5896
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4800
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:552
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3124
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a110.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2164
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4332
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AC.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                              PID:4144
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a229.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B5.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:2972
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a332.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2580
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CF.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:3476
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:3380
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C9.bat
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4620
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:2008
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D2.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:3404
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:4556
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DC.bat
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:1764
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a834.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:2240
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97C.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4B.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:4056
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1772
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE1.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a112D.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3176
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1246.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:1588
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a142A.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1543.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:6040
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:980
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a164D.bat
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1795.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:4432
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18AE.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4324
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:5400
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a195A.bat
                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:5688
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A93.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:5464
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:2880
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B7D.bat
                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                PID:1908
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C29.bat
                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:1816
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CB6.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                        PID:2116
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:2596
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D42.bat
                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:1124
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:5136
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DCF.bat
                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:1388
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6B.bat
                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F07.bat
                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                              PID:3608
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FA4.bat
                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a207E.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:3684
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a211B.bat
                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21B7.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:5204
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2253.bat
                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:3372
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22EF.bat
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2928
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a237C.bat
                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2409.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3688
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B5.bat
                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:1672
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1796
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2580.bat
                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5364
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5620
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a261C.bat
                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3160
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2699.bat
                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a285E.bat
                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2997.bat
                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a306D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3212.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3280.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a330C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3389.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3435.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a385C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3975.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4135.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a427E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a430A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a454C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4685.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5652
                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                        2⤵
                                                                                                                        • Creates a file in the Startup directory
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Enumerates connected drives
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3308
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                          3⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4596
                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                            4⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4344

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Reconnaissance

                                                                                                                          Resource Development

                                                                                                                          Initial Access

                                                                                                                          Execution

                                                                                                                          Command and Scripting Interpreter

                                                                                                                          1
                                                                                                                          T1059

                                                                                                                          Windows Command Shell

                                                                                                                          1
                                                                                                                          T1059.003

                                                                                                                          Persistence

                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                          1
                                                                                                                          T1547

                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                          1
                                                                                                                          T1547.001

                                                                                                                          Privilege Escalation

                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                          1
                                                                                                                          T1547

                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                          1
                                                                                                                          T1547.001

                                                                                                                          Defense Evasion

                                                                                                                          Credential Access

                                                                                                                          Credentials from Password Stores

                                                                                                                          1
                                                                                                                          T1555

                                                                                                                          Credentials from Web Browsers

                                                                                                                          1
                                                                                                                          T1555.003

                                                                                                                          Unsecured Credentials

                                                                                                                          1
                                                                                                                          T1552

                                                                                                                          Credentials In Files

                                                                                                                          1
                                                                                                                          T1552.001

                                                                                                                          Discovery

                                                                                                                          Peripheral Device Discovery

                                                                                                                          1
                                                                                                                          T1120

                                                                                                                          Query Registry

                                                                                                                          1
                                                                                                                          T1012

                                                                                                                          System Information Discovery

                                                                                                                          1
                                                                                                                          T1082

                                                                                                                          System Location Discovery

                                                                                                                          1
                                                                                                                          T1614

                                                                                                                          System Language Discovery

                                                                                                                          1
                                                                                                                          T1614.001

                                                                                                                          System Network Configuration Discovery

                                                                                                                          1
                                                                                                                          T1016

                                                                                                                          Lateral Movement

                                                                                                                          Collection

                                                                                                                          Data from Local System

                                                                                                                          1
                                                                                                                          T1005

                                                                                                                          Command and Control

                                                                                                                          Exfiltration

                                                                                                                          Impact

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          $$aA766.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aA766.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 e8198b10e68cfe91d3a6c827e1ec15e3607d2003a7c8383088403ac623e2f202
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aA9D7.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aA9D7.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 08033782cc08f45c621fc40bff9faa78a8ccae96ac882293f3b1772febd8f709
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aAC68.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aAC68.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 521556bfc49d960590dbba6b85a593ccd35a54a0f468ff33ed81fe263c24d929
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aAEC9.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aAEC9.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 81f20f5c16814c12d1a4c49a37b3d2e9a70f7b99023df1e23d52000c949fca6d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aB244.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB244.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 647ce52c4de02397ab36948b2326cd67d0cd1ca352175de2c1bbfa7310a9ef1f
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aB570.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB570.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 c21c2e30ebd2e177b520409b7f81ab9c713bfcdcf113afccd3e573a28fd75167
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aB86E.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB86E.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 b7c99ac71dd23072ea653ab17e549a609631081b0d18ec0c0cb09ce29129ccb0
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aBAFE.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBAFE.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 5a98175b2525bf22a598224ad0d2182108769b0f3887adb7c4300e91d8665db6
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aC09C.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC09C.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 f374f9fbe3519982589a55d00676a406e1c0aa5162debd5c8bc9c6e0629ff570
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aC2CE.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC2CE.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 b6b63cc9dcf9dee7b3bb67e4148eebd366734e3ae2846a0d3620e031050f561e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aC668.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC668.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 463043dcd34013a13aa069cf0add8f3f9f25d04b81182672b91c522d0152c537
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aC985.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC985.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 a68456e588ad2bead155176c6514b2e78c1260aeb57736ab2357a6d174eae5b8
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aCEA5.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCEA5.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 8e5ece0476996db57a9f43e658ae6756ea119c496cfe44fd7a4f2eb295cf4b5f
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aCFDE.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCFDE.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 c81c2bd10fe0da36247e818890839444cd064ac91a419bfe0e253945f00735a8
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aD358.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD358.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 746d992b28fff28aa651944a96656c6bce8e8865e0b08f4730752d8ec65e56fc
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aD675.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD675.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 b0fdd68a341b93de3908536cbc7c6c73f779937bf3b4cd607b44b57a61af466d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aD8E6.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD8E6.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 1d544461be207ffa1cf9848b5e8fe5923cd9dc1651e2f1c8574eb878dff7c338
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aDC03.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aDC03.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 011668558597662962bcc20cbb8ceb2c82b97353921fcbefc4d53c5633729b7e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aE28B.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE28B.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 64517ed4ab16e64a762d27ff54c8fdc6ec429bdda0e49096e94348f7c8a8f906
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aE598.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE598.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 ac6be25c55cd0bdcb83035d639dc8fb770ee3b6127c2b77ee59f5e6c7fd26b56
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          $$aE886.bat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE886.bat
                                                                                                                          • Size 776B
                                                                                                                          • SHA256 09523fb14f78ba2397ec3471a2c3c5e081bc9688e703b83169558758967ae561
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe
                                                                                                                          • Size 4.0MB
                                                                                                                          • SHA256 fb6917944831c0ea1c6aa2d2a025a365d8732c54a1c31767c7a7b4bd59ab926d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.5MB
                                                                                                                          • SHA256 9f58299e9a11e193741722e506c3f143b6558094ed651345d7e750f06d390e0c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.2MB
                                                                                                                          • SHA256 ea486600d7fc92344bf62148e9505f6406d862a2cef8062edd4d70afff46fb5a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.2MB
                                                                                                                          • SHA256 f2067f7267d5e9a2e028e9572f04d0fd3a74d692884bfb18d1490c1269619520
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.2MB
                                                                                                                          • SHA256 f7b6f029b520c07d44a29b95e5ae5478b1ba0fb879b818bf82ea82e9b0a695f4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.2MB
                                                                                                                          • SHA256 86055c89bbd0bc09853b043b6b34a2da39d84a91ea08bd6883d3606b95d6c59f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.1MB
                                                                                                                          • SHA256 8e9c1eb16c06b14454295d8380e281a53c80e625c9c02c2d0da5fd690a3e4f66
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.1MB
                                                                                                                          • SHA256 7b8f3fa0e9ebd9de886da3298ed918b111c9852d680d2d3e1f2d4f9b79e45ee1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.1MB
                                                                                                                          • SHA256 3cdeb14f9293ea60271b748f95a5bb7f0332c657bd13b879c6d5e5ea02250ac3
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.0MB
                                                                                                                          • SHA256 cd0d3ec896bc76f3b947e4abcc8e8103fc8151f06e4b2ccff8bdddb3d9adc9b9
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 3.9MB
                                                                                                                          • SHA256 8ddd9f9716c12bcdfc440ff9693e25b9553ab8672cde22f354f2b8e43df3f032
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 3.9MB
                                                                                                                          • SHA256 182fb402167321cf7dc54d007c9adf858f8e14264cb44ac6949939a6dd8e66b7
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.5MB
                                                                                                                          • SHA256 a73cf8959c2b7fe31d6d14d4fe53d428d4d70ae2693eca03676c32fde9d51525
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.4MB
                                                                                                                          • SHA256 3251d73110de37b49aaae161d8a4a8e3e28c8884025f82400e19b4f1d4ad0aa2
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.0MB
                                                                                                                          • SHA256 81ba27e1a149d5e394a3054c0ccebdd63256fb77cbafa01ae7b9b2c3f8f3f33c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.4MB
                                                                                                                          • SHA256 17422b5b9da547bf61895522b20215ce4c2a5f2f2fbadec7eec297fcf9a799f1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.3MB
                                                                                                                          • SHA256 172ad7ad0c17dc7659e04660d44aaff43df69179968ee86131171128a73837f2
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.4MB
                                                                                                                          • SHA256 2793a20aaad4bc6658755b5145979809bace43cafa8943f6fc8327f374328d10
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.3MB
                                                                                                                          • SHA256 c65737b892c4ac7892ece241500baa80e55c938ae76c579a05e4d9b394ea8ab1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_398420596f975ecdf2cb4c8888dbcffa_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                          • Size 4.3MB
                                                                                                                          • SHA256 d94e82187d08ea7a76a2ca972d6cdbe57f6269287d2fc122610626e274d86a70
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Logo1_.exe
                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                          • Size 32KB
                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          _desktop.ini
                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-681733028-2344970462-962213935-1000\_desktop.ini
                                                                                                                          • Size 9B
                                                                                                                          • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          memory/112-1315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/208-5705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/412-10597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/700-10602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/860-10682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/900-5713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/980-9888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1176-1198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1220-10697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1440-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1500-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1588-9452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1692-10722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1752-3077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1764-6888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1772-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1780-3385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1796-10527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1816-10456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1876-10592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1884-10672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1908-10451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1924-4355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2008-6506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2036-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2040-2860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2072-10662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2076-5223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2240-7204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2480-10702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2536-6238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2552-10172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2576-10577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2596-10462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2644-6278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2808-5400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2832-10627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2880-10446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2928-10512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2944-10642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2972-6282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3024-2277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3116-10727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3124-6266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3152-10492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3160-10537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3176-8894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3192-6234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-1528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3308-5681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3328-10612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3352-10547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3372-10507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3380-6366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3388-145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3424-5966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3592-10717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3648-6286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3688-10522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3792-10632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3804-5721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3908-6230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3968-10607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3992-10692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3996-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4108-10743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4112-5701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4188-617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4208-10687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4292-10677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4332-6270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4424-10587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4432-10396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4448-10617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4464-6254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4472-10657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4548-10497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4556-6664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4584-1532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4592-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4644-10622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4656-10562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4680-10542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4684-37-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4728-6274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4756-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4756-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4780-10517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4800-6262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4884-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4948-10637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4960-10764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4960-10759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5056-10487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5060-10748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5072-3586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5080-10582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5092-10567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5128-1021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5136-10467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5176-10572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5192-10477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5204-10502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5220-10472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5236-6242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5256-10737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5372-5697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5388-10557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5400-10436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5424-2123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5456-10482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5480-10758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5488-6250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5536-1935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5584-1748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5588-6246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5620-10532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5684-10712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5688-10441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5728-10667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5736-5084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5744-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5904-10753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5920-10707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5928-10552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5932-3204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5956-9700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5964-5717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5972-5709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5992-10732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/6020-10652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/6060-10647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/6120-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                          Download