Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 16:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
  • Size 5.5MB
  • Sample260930-tpw75szdrf
  • SHA256 aa329d9ca8a67da4aeecd8dcb9808b9fe9db49369848d833581d47bb88021829
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D47.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3656
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1584
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2248
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75B3.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4604
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a792E.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5168
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:6012
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CC7.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5388
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:820
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1064
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5004
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84B7.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1088
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5980
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A54.bat
                                  16⤵
                                    PID:3704
                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:4500
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
                                        18⤵
                                        • Executes a command shell one-liner
                                        • Suspicious use of WriteProcessMemory
                                        PID:4320
                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:4696
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92EF.bat
                                            20⤵
                                            • Executes a command shell one-liner
                                            • Suspicious use of WriteProcessMemory
                                            PID:2648
                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • Suspicious use of WriteProcessMemory
                                              PID:4740
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a967A.bat
                                                22⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:3360
                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:828
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99E5.bat
                                                    24⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6036
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2892
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D21.bat
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3204
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4792
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                            28⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:988
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4256
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4D1.bat
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4956
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4664
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                    32⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3388
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2036
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                        34⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3532
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5600
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE28.bat
                                                                            36⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:920
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                              37⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3684
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB155.bat
                                                                                38⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1624
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                  39⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Windows directory
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5408
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB433.bat
                                                                                    40⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1172
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                      41⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1468
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB55C.bat
                                                                                        42⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5840
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                          43⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2148
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
                                                                                            44⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:576
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                              45⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2136
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7BD.bat
                                                                                                46⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:564
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                  47⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5812
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                    48⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4912
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                      49⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1328
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9D0.bat
                                                                                                        50⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4852
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                          51⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Windows directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2680
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                            52⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4392
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                              53⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1368
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                                                                54⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2624
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                  55⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:6084
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
                                                                                                                    56⤵
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4456
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                      57⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3064
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEC2.bat
                                                                                                                        58⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3088
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                          59⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3512
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC00A.bat
                                                                                                                            60⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:2972
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4264
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                62⤵
                                                                                                                                  PID:2896
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4564
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1FE.bat
                                                                                                                                      64⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3464
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4468
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC317.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4348
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4360
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:796
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1916
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:5528
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:704
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6B1.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:5968
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:4280
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:2124
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2644
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:5844
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:3024
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9BF.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:1080
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:4700
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB16.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5788
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:4880
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC01.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:2336
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5136
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:3060
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:5404
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE24.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1508
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF0E.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3068
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:5444
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD102.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:1792
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1DD.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:360
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2E6.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                        PID:1900
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3540
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3E0.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FA.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5F4.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD70D.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                          PID:5776
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:3372
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD865.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:1552
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:3516
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA97.bat
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4588
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB62.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:3352
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC9B.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5832
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:1712
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD85.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:1272
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFA8.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:1800
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE092.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4116
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE16D.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5008
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE257.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE390.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:672
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE45B.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                          PID:3144
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                              PID:3164
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE555.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:3864
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63F.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:3980
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE70B.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:1224
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:5908
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE833.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                    PID:2816
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE91E.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E9.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:3612
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAF3.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBDD.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:4396
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2164
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECA8.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDB2.bat
                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5704
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:2408
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF96.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:904
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:5068
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF071.bat
                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2552
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5808
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF16B.bat
                                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF255.bat
                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF36E.bat
                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF534.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF60E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF708.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAA2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBCB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD71.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a272.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a428.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1176.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1251.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a132B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1668.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1704.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2193.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a227D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2348.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a257B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2617.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a276F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2953.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ACA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3058.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3123.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:1888
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                          PID:5484
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                              PID:2228
                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 996
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:6084
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4488 -ip 4488
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3104
                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3812

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                  $$a6D47.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6D47.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 5159b26937345959aabd0f09e84c386b42df717aaab06b0c313036da49f5fc24
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a712F.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 25c1a396e78aadc3a60f6a029cdad13cf9f27359cf28b05f231e8f19f8a6b93f
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a75B3.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a75B3.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 45178b5faf08e02a77eddf11026091c28d936789f7606d915d9266ab4949e165
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a792E.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a792E.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 3db05e3f5f1b9b37d30b3fd6529236456378068c70436a0f2d2d853ae1201116
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a7CC7.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7CC7.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 1f6bfd1316342be6671fea6ffc4b594deeea14f24d6b2d40b5b87bd220d679b5
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a8061.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 68d20df312359d19d5bfc723be01ce3b8f8456f1706ffd60bbca82525298a1bd
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a84B7.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a84B7.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 94c096413a907819138ad4b572be23c7c57732a958529b6932b48767a8ed4680
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a8DFE.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 f0745db580ee144c68739e002db81bb887a58862e79257c408187211eb1f4259
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a92EF.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a92EF.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 d5401924eb4711199b1e70d1c0ac79228a98fe9bba4a49fbc4676f4695e8650d
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a967A.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a967A.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 65f4dd63eeccf0f35bfe4d2031c8df300bbcfea35930ed485fb1a8efcdfffb6b
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a99E5.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a99E5.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 86531daa940cf10b2ec14255e4c68d383b8fffc1a42f64dda2f00e2bc71e3abb
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$a9D21.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9D21.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 bae6691a7f94b9ad84376d0f84a8b9374c615b471ea0f25747c4876d7966b998
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$aA07C.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 cb495d011f35de9bfc51e7e775d7ac2719e67acda6412cbec270f27bb63545d8
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$aA4D1.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA4D1.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 0b0ae0f7c53dfa705058fe0fb5a8f48a7af69a37099d30d676d47b1cf74cd63d
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$aA771.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 13896a2d8fa8db983aae730091ec5799e436c52a490f42076eaa5d33717ca4e0
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$aAB1B.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 6c9b807ffa3d3f741038ca6aaec487045e660afe250c0d1b2a861dfc95929370
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$aAE28.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aAE28.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 193b54d4926bb201af8ddf32f5f9508c68cb78c7c372191961bc0a0ccee3a5d8
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  $$aB155.bat
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aB155.bat
                                                                                                                                                                                                                                  • Size 776B
                                                                                                                                                                                                                                  • SHA256 b90948c0af40e26fa5c1387122e6e9f8addb3ce236b15b7b9d14de2a6c959d11
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                  • SHA256 7c2e99cdcd19589a26f3e1e05716c9927a624e1ab39a0246e394eee7c25ad8f7
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                  • SHA256 df7caa6dca63fd0da21ea818b82cfad5e14c35b9a3609882d518679359d4a672
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                  • SHA256 50f02e8dd19f5769cc3c1218acde96306e7fdbbdc0abac422c37980375e425ae
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                  • SHA256 459f6450a3486bea2f0240a3dae89bcbd900a39e9e04260ef16fcd7b1a255e01
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                  • SHA256 10e64c66d2ed9407c24a6b23d07d944de37690a464c649ed0a4c04b8ee776ee5
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                  • SHA256 635ac0d5b188f70a9cf6490760d67d33de6029ff018e97d03297331e8be42da3
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                  • SHA256 ebc801a930ec45a720394fbd4cb77649b8ac32b3655dcc083ad484fa3f98d359
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                                  • SHA256 6689baf0755bafa5043f99087d42a6db551b8cb8c91c7552f2aa4854e46261ea
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                  • SHA256 8a6e7193be58301f74dd5636aee6ddfd0e41f2655360b67a2b6237a2a1541f51
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                  • SHA256 02bcb59f345d5ecb9896c5c0d17b81e5bd03646e19664cce06ce5e60b7189a9c
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                  • SHA256 17c5e6f5609a48208113f15f0360a22978c96162a25fd15aa3a8627b710f7efc
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                  • SHA256 e7b68805074be8f1e1ceb3ba5b7f03f40439a5cef771de4e474aec00659ca790
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                  • SHA256 b7bb0dace3e718c5893c1cd7f3af901d1d2d498413b63a5d4de9da25db2738bc
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                  • SHA256 66e7d7b545829b036849af5bfea2b0667c9624bf7f02c28be065ab7e0c97064b
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                  • SHA256 e2836a98aa06b134a4903b42757b60d7074b70fb27144013dcd1e85b75ed9b77
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                                  • SHA256 9a8dd707b1ab6b6f936726d5fcb01da23c64017bf8cc5cca5428f23a2b7e2cde
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                  • SHA256 efb1539843bca954cf60583e3c11534e06d5bc4dd747678b6a7d22176f173fdc
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_d7c7a2147101a6b42467c4c07742fd1b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                  • SHA256 e847240470793e68da5cb4db8fd8c39e9551fd6c82bd5bb143d74962e41749ee
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  Dll.dll
                                                                                                                                                                                                                                  • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                  • Size 68KB
                                                                                                                                                                                                                                  • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                                                                                                                                                                                                  • Size 9B
                                                                                                                                                                                                                                  • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                  memory/240-648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/412-972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/672-701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/692-821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/704-553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/820-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/828-409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1192-924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1292-1098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1320-1140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1328-498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1336-674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1368-508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1420-942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1440-1225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1468-477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1500-996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1524-960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1552-643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1556-1182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1580-737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1656-918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1712-664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1728-905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1764-1122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1824-1062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1888-478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1888-654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1888-445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1896-1176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1916-548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1928-613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/1952-881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2036-450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2044-1110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2136-488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2148-483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2164-755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2248-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2324-1128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2348-899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2396-815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2404-1104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2516-791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2644-563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2656-684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2680-503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2824-803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2892-417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/2968-1086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3008-1050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3024-568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3040-1002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3064-518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3136-1231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3164-707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3168-1068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3240-863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3328-1207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3372-638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3408-1074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3420-593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3460-869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3512-523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3540-618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3612-743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3656-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3684-466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3688-1020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3700-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3756-930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3800-1213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3864-713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3872-669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/3952-1032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4112-695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4148-893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4176-839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4200-1158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4256-433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4264-528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4280-558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4300-1152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4304-948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4360-543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4408-845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4468-538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4488-365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4488-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4500-378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4508-1194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4524-623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4564-533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4588-653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4592-1008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4632-659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4656-761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4664-441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4692-598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4696-389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4700-573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4712-628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4740-399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4776-887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4792-425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4800-990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4840-833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4880-578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4900-984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4920-1080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4948-1044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4992-731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/4996-1164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5004-124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5008-689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5068-779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5072-1026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5096-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5096-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5100-749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5136-583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5152-608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5164-797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5184-1038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5284-809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5320-978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5372-633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5404-588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5408-472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5444-603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5448-1014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5460-1237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5472-1188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5476-1116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5556-936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5560-857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5580-679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5600-459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5608-1200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5616-773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5628-851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5632-1056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5672-966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5704-767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5808-785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5812-493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5836-1219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5856-954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5884-1146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5908-725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5912-1170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5952-1092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5956-719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5976-912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/5980-364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/6012-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/6064-875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/6084-513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/6132-1134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                  memory/6140-827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                  Download