Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
  • Size 5.0MB
  • Sample260930-wpghsssyb1
  • SHA256 4eae829d551ea87ea476b83125d72f108b30c42870f80e03424fbd8d0831995f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16CA.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4104
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4120
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a194B.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1044
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5840
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D52.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3264
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3324
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a213A.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4456
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4944
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24E3.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:264
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:6052
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a285E.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3968
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2204
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C46.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2000
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2044
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34E1.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5944
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5572
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3762.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1080
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5532
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49E0.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3436
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1964
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BE4.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:920
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2544
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51DF.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4560
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:296
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54AE.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2052
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2760
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57DA.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2404
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1668
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61EC.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3060
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4720
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a649C.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1792
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5364
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6930.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2524
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4472
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4664
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3908
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71EA.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:888
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:584
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75D2.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1716
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5912
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1032
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4652
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CB8.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1576
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5624
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DB2.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1744
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5872
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ECB.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3712
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3360
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD5.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4648
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4448
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80FE.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5524
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5832
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8217.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1492
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4516
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835F.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3240
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5440
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8488.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1416
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4220
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85D0.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5304
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3328
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86F9.bat
                                                                                                                              62⤵
                                                                                                                                PID:1424
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2004
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8831.bat
                                                                                                                                    64⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:5700
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4424
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:5884
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2592
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A73.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:2476
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4628
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B6D.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:5484
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4512
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C77.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5932
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:1680
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D90.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:4480
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4192
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EAA.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:5404
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:120
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:2816
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:2784
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90AD.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5692
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:492
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9188.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:2112
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:5400
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D0.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:1748
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2400
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9409.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                          PID:4872
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:4736
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a958F.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2820
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96E7.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:2296
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:3300
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2912
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:1940
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A71.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B7B.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:4828
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:5588
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                            PID:5348
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:5276
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2680
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F15.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA03E.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:468
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA147.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                PID:3196
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:3836
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2AF.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:4524
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:628
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3B8.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5828
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA677.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:3792
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA781.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                  PID:3992
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3440
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:6140
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2948
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA985.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA7F.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:3820
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC44.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:5468
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD6D.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE76.bat
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                  PID:3896
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                      PID:3952
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFAF.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:2164
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                            PID:1448
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0A9.bat
                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:1480
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:480
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB193.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:1296
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB24F.bat
                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                          PID:4724
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                              PID:2908
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:3740
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB452.bat
                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                        PID:4832
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                            PID:4804
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4936
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3856
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB675.bat
                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:608
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:1876
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB78E.bat
                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:6012
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:1196
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:764
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB992.bat
                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA7C.bat
                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:3276
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat
                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4004
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD3B.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:5788
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:3408
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE35.bat
                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5796
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC162.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC23D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC346.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC440.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC54A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC644.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC76D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC886.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD21B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD315.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD47D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD557.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD893.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD95F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE063.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE12F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE390.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE526.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE72A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE882.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE90E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECA8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1840
                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:5880
                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:5664
                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:4596

                                                                                                                                                                                      Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                            Resource Development

                                                                                                                                                                                            Initial Access

                                                                                                                                                                                            Execution

                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                            1
                                                                                                                                                                                            T1059

                                                                                                                                                                                            Windows Command Shell

                                                                                                                                                                                            1
                                                                                                                                                                                            T1059.003

                                                                                                                                                                                            Persistence

                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547

                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547.001

                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547

                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                            1
                                                                                                                                                                                            T1547.001

                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                            Credential Access

                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                            1
                                                                                                                                                                                            T1555

                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                            1
                                                                                                                                                                                            T1555.003

                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                            1
                                                                                                                                                                                            T1552

                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                            1
                                                                                                                                                                                            T1552.001

                                                                                                                                                                                            Discovery

                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1120

                                                                                                                                                                                            Query Registry

                                                                                                                                                                                            1
                                                                                                                                                                                            T1012

                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1082

                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1614

                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1614.001

                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                            1
                                                                                                                                                                                            T1016

                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                            Collection

                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                            1
                                                                                                                                                                                            T1005

                                                                                                                                                                                            Command and Control

                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                            Impact

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            $$a16CA.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a16CA.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 d6b28c3f2da6932c5c1c119d99ed2c0549a072415690c8f423fe534713dac84c
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a194B.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a194B.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 1e1cc57e53546c61165c381120c2c62750e7754d101b2d71bdd1107fd146ad71
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a1D52.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1D52.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 7254f545a65ac8a0aea5b452d479ada824eb0e2893f4b7a3e54015832b5183ed
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a213A.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a213A.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 f80813baf619f439417c383f4688bc15f65e72a65f56dfbd2902f89335a66269
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a24E3.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a24E3.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 61d3144b699bff35ecaf7de8d3c85993d4d7a6005b6a2eb59cedf2d61d482a75
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a285E.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a285E.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 78ebd673868693e6fb28a27ff1b8e7e59ecd1d45db161e478f9c9d409ed6617d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2C46.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2C46.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 a75fb0576836228b14954e137f8dc1e95f1bca316e9c4e4e7b557832b01a40db
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a34E1.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a34E1.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 9f24036a0adf0d89c7d961072bbdcd3984aabcffa31776f7f6422708cc8a0ff8
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a3762.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3762.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 495cb961c0963d05d1accaeaed6edca2ee94575988ece9c74c4f0e584a5e88d0
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a49E0.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a49E0.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 a640a371616fd45c4a7484a9efa8e978bb32ddbedbed08835e10a3e7a31c9210
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a4BE4.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4BE4.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 196d5a6ed192723ccd565999420bd4a1ae9f94f4aa55ca27cdf1594f3ee2d0e7
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a51DF.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a51DF.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 cab5782cea840b50d93966e61af3af1ca933f5ef39bcd9302582d82513523ecf
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a54AE.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a54AE.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 70b6037da5cfe74ed3717842fde60867f3d313429aaa8676b40442a3a444aa14
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a57DA.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a57DA.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 94770793aa9de0018452da85f8e852684ff563181eb745e8ce7016238b8a6c11
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a61EC.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a61EC.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 e2772a66e66fa8dd308aceb67de1f5b462874f09c72fd787597ce4a51911e278
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a649C.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a649C.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 d35bd99f88a4163f25be2393d3ab067db2481a57c90d45e7a7572345184bb1fc
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a6930.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6930.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 cf86a7b4c8fb36f49073ed153f2cc87b85040bcfd504a413132c0eab48d8ef68
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a6DA4.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b9f77a70ebde858866b19323546bd2b582d201b39512c32d9e13a4705cf53177
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a71EA.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a71EA.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 ca7f10945b35b323130eaf4b2c54be218fac1bb3d5ddef83b19c1c42fd1732f2
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a75D2.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a75D2.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 b170672747593c6fbac805c94dd97de05f4283aa334204da8f17b2b0b6612a57
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a795C.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                            • SHA256 106b83052b9e709857dc7ad8c90c7029b6b38afb6369ed2ba8cbf3e56ab9bf2a
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 118b77b7ff5abf596f333169bc5cbb14b927be761aae3cb052001cd741a1ec3e
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 4c115bffb15063bd24cb84706b5e8c26f7ea1579d18ce2148747c64c21e6dc39
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.5MB
                                                                                                                                                                                            • SHA256 57be183bed7b4983f36a1ebccb1963f18287f977eeefef8bd050d9496263d789
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.5MB
                                                                                                                                                                                            • SHA256 0a60cf9167890e8090f62ace8e994ae6cd6057680513b51d65c7ffecd7a7ef58
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.4MB
                                                                                                                                                                                            • SHA256 26fdddfa36202b6d7dce82a1b9104e769539f20c57d8bf40960106aabe65b79c
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.5MB
                                                                                                                                                                                            • SHA256 3a8523d241843db1e3b32149467d4f180a5aff2cfe707c37c7cea81ea5870d71
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.4MB
                                                                                                                                                                                            • SHA256 189ae9f15dccdb2d1fe358af4bb46c34aa3f4ad362d4955bf891d48e5ebc24ec
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 b136bbaf4ae64a5a51ecdbaab95b368b608010cbfdfd0c2c2940a7ab4f48af95
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.4MB
                                                                                                                                                                                            • SHA256 7a0e06dc7614054e903ef99b2205bdd0b719f17249d5d558e5265ffc239dee8d
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.3MB
                                                                                                                                                                                            • SHA256 f5a43b049129e57fa7099004cc45c7f916811e8759f321028fc08ceb91857603
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 597d565a01ae1cd154d88b47047ec48625d4f714bdce82e5344bafd02a81ebb0
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                            • SHA256 887e6d3272b91bfdfa4658e1bfebc567da0de1b7072b23b964118f781d28182b
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 a0ad0b8a54d561eaead5b309e7fa6bad0b2090218802d4c185d3bf654c7f9c04
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.7MB
                                                                                                                                                                                            • SHA256 79f7e89741b884ef59827c5973681578b4c5d716dcd692cd5e038bf5bd48aa87
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 9d1bef317754fb0b72390facf300f3d3b36ca187539bd1ec7f468ac56d6017d2
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                            • SHA256 4dd15ead602661df284888b733ec93b38d24ed9ba956e6b7aa2b14658ac965bf
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 74b02d36665c5cf41e31e877334d6f1184de115a431b9d101b8a369666889ea3
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 9b36ffb759d54a03537dd536ae470ec2c7b9209a450de7aead937d0d03b57a37
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.8MB
                                                                                                                                                                                            • SHA256 4caed8cd2d75e6a296bf83ab22fb8058cc0d5ae86c77f99f1d27a1f25be01b12
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_9f238b60d6ef016e0b975ba41a02495b_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                            • Size 4.6MB
                                                                                                                                                                                            • SHA256 e85a2e75813a3cf2009ad2e2050f5fe5db17405293b23dd6d993d059005eac1a
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-650287814-2715975232-1279715623-1000\_desktop.ini
                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                            • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            memory/120-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/200-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/252-8770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/296-6046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/356-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/364-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/444-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/480-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/492-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/584-8078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/624-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/628-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/764-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/800-8752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1048-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1064-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1124-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1300-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1328-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1332-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1348-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1448-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1644-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1648-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1668-8035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1680-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1684-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1708-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1752-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1856-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1876-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1940-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1964-5569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1976-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2004-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2044-1822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2068-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2108-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2204-208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2296-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2400-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2448-8764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2528-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2532-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2544-6038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2584-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2592-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2680-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2716-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2744-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2756-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2760-6058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2784-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2864-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2880-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2908-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2948-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2972-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2976-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3036-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3044-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3168-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3276-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3324-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3328-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3360-8107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3408-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3440-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3496-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3556-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3632-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3740-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3760-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3776-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3792-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3836-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3856-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3908-8070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3916-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3936-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3952-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4004-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4120-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4136-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4164-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4192-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4220-8132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4312-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4328-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4356-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4392-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4424-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4448-8112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4472-8062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4512-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4516-8122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4548-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4552-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4552-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4576-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4612-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4624-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4628-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4652-8092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4716-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4720-8043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4736-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4768-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4800-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4804-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4816-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4856-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4932-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4944-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5056-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5176-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5268-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5276-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5296-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5360-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5364-8054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5372-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5400-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5440-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5532-5561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5572-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5588-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5596-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5624-8097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5652-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5696-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5716-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5736-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5784-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5804-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5832-8117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5840-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5872-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5880-1844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5880-8047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5880-2764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5880-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5912-8086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6000-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6012-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6016-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6016-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6044-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6052-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download